{"id":2343,"date":"2026-10-30T10:20:20","date_gmt":"2026-10-30T07:20:20","guid":{"rendered":"https:\/\/www.net-security.ro\/?p=2343"},"modified":"2026-10-30T10:25:41","modified_gmt":"2026-10-30T07:25:41","slug":"ordinul-1-2026-anexa-1-masurile-de-gestionare-a-riscurilor-de-securitate-cibernetica-aferente-retelelor-si-sistemelor-informatice-utilizate-de-entitatile-esentiale-si-importante","status":"publish","type":"post","link":"https:\/\/www.net-security.ro\/index.php\/2026\/10\/30\/ordinul-1-2026-anexa-1-masurile-de-gestionare-a-riscurilor-de-securitate-cibernetica-aferente-retelelor-si-sistemelor-informatice-utilizate-de-entitatile-esentiale-si-importante\/","title":{"rendered":"Ordinul 1\/2026 Anexa 1 M\u0103surile de gestionare a riscurilor de securitate cibernetic\u0103 aferente re\u021belelor \u0219i sistemelor informatice utilizate de entit\u0103\u021bile esen\u021biale \u0219i importante"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\n\n<\/p>

\n\n

de gestionare a riscurilor de\nsecuritate cibernetic\u0103 aferente re\u021belelor \u0219i sistemelor informatice utilizate\nde entit\u0103\u021bile esen\u021biale \u0219i importante<\/span><\/b><\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

Art. 1 –\nStructura m\u0103surilor de gestionare a riscurilor de securitate cibernetic\u0103<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

(1) M\u0103surile de\ngestionare a riscurilor de secur<\/span>itate\ncibernetic\u0103 sunt organizate \u00een \u0219ase Func\u021bii, dup\u0103 cum urmeaz\u0103:<\/span><\/p>\n\n

a)  <\/span><\/span>Guvernare\n(GV) – asigur\u0103 tratarea securit\u0103\u021bii cibernetice ca prio<\/span>ritate strategic\u0103 \u0219i stabile\u0219te politicile, <\/span>responsabilit\u0103\u021bile <\/span>\u0219i <\/span>atribu\u021biile <\/span>de <\/span>autoritate, <\/span>care <\/span>sunt <\/span>comunicate <\/span>\u0219i <\/span>revizuite la\nnivelul entit\u0103\u021bii;<\/span><\/p>\n\n

b)  <\/span><\/span>Identificare\n(ID) <\/span>– asigur\u0103 \u00een\u021belegerea activelor,\nsistemelor, persoanelor \u0219i <\/span>datelor\nrelevante, precum \u0219i a riscurilor asociate, <\/span>fundament\u00e2nd\ndeciziile privind gestionarea riscurilor de securitate cibernetic\u0103;<\/span><\/p>\n\n

c) <\/span>Protec\u021bie <\/span>(PR) <\/span>– <\/span>cuprinde <\/span>m\u0103surile\nde <\/span>protec\u021bie, <\/span>de <\/span>natur\u0103 <\/span>tehnic\u0103, <\/span>procedural\u0103 <\/span>\u0219i <\/span>de\ncon\u0219tientizare, menite s\u0103 reduc\u0103 probabilitatea producerii unui in<\/span>cident sau s\u0103 \u00eei limiteze impactul;<\/span><\/p>\n\n

d)  <\/span><\/span>Detec\u021bie <\/span>(DE) <\/span>– <\/span>sus\u021bine\n<\/span>detec\u021bia <\/span>prompt\u0103 <\/span>a <\/span>evenimentelor <\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>\u00een <\/span>vederea reducerii\ndaunelor \u0219i a unui r\u0103spuns mai rapid;<\/span><\/p>\n\n

e)  <\/span><\/span>R\u0103spuns\n(RS) – cuprinde ac\u021biunile \u00eentreprinse la producerea unui incident, pentru li<\/span>mitarea acestuia, coordonarea comunic\u0103rii\n\u0219i reducerea perturb\u0103rilor;<\/span><\/p>\n\n

f)   <\/span>Recuperare <\/span>(RC) <\/span>– <\/span>vizeaz\u0103\n<\/span>restabilirea <\/span>serviciilor <\/span>\u0219i <\/span>a <\/span>opera\u021biunilor <\/span>afectate <\/span>de <\/span>un <\/span>incident,\nprecum \u0219i valorificarea lec\u021biilor \u00eenv\u0103\u021bate pentru cre<\/span>\u0219terea rezilien\u021bei.<\/span><\/p>\n\n

(2) <\/span>Fiecare <\/span>Func\u021bie\n<\/span>prev\u0103zut\u0103 <\/span>la <\/span>alin. <\/span>(1) <\/span>se <\/span>\u00eemparte <\/span>\u00een <\/span>Categorii, <\/span>fiecare\n<\/span>Categorie <\/span>se <\/span>\u00eemparte\n<\/span>\u00een<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Subcategorii, iar fiecare Subcategori<\/span>e cupr<\/span>inde\nunul sau mai multe Controale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(3) <\/span>Controalele <\/span>reprezint\u0103 <\/span>cerin\u021bele <\/span>de <\/span>securitate <\/span>ciber<\/span>netic\u0103 <\/span>ce <\/span>trebuie <\/span>implementate <\/span>de <\/span>c\u0103tre <\/span>en<\/span>tit\u0103\u021bi\n\u0219i <\/span>constituie, <\/span>\u00een <\/span>ansamblul <\/span>lor, m\u0103surile <\/span>de <\/span>gestionare <\/span>a <\/span>riscurilor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>prev\u0103zute de <\/span>prezentul <\/span>ordin. <\/span>Un\nControl <\/span>poate <\/span>consta <\/span>\u00eentr<\/span>-un <\/span>proces, <\/span>o <\/span>politic\u0103, <\/span>un <\/span>dispozitiv, <\/span>o <\/span>practic\u0103 <\/span>sau orice alt\u0103 ac\u021biune cu rol \u00een\ngestionarea riscurilor.<\/span><\/p>\n\n

(4) Fiecare Control este\nidentificat printr<\/span>-un cod alfanumeric\nunic, <\/span>av\u00e2nd forma \u201eXX.YY-NN.MM\u201d, \u00een <\/span>care <\/span>\u201eXX\u201d <\/span>desemneaz\u0103 <\/span>Func\u021bia, \u201eYY\u201d <\/span>Categoria, <\/span>\u201eNN\u201d <\/span>Subcategori<\/span>a, <\/span>iar\n\u201eMM\u201d <\/span>Controlul <\/span>din cadrul Subcategoriei.<\/span><\/p>\n\n

(5) <\/span>Anumite\n<\/span>Controale <\/span>sunt <\/span>marcate\n<\/span>ca <\/span>M\u0103suri <\/span>cheie <\/span>pe <\/span>baza <\/span>tipurilor <\/span>comune <\/span>de <\/span>ata<\/span>curi <\/span>cibernetice<\/span>. M\u0103surile <\/span>cheie <\/span>sunt <\/span>obligatorii <\/span>\u0219i <\/span>trebuie <\/span>tratate\n<\/span>cu <\/span>prioritate, <\/span>conform\n<\/span>nivelului <\/span>de <\/span>asigurare\n<\/span>c\u0103ruia le sunt aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

(6) <\/span>Anumite <\/span>Controale <\/span>sunt <\/span>marcate\nca <\/span>fiind <\/span>aferente <\/span>unor <\/span>Aspecte <\/span>de <\/span>management, <\/span>corespunz\u00e2n<\/span>d\nprincipiilor sistemelor de management pe care standardul ISO\/IEC 17021<\/span>-1 le impune auditorilor s\u0103 le evalueze,\nrespectiv: impar\u021bialitate, competen\u021b\u0103, respons<\/span>abilitate,\ndeschidere, confiden\u021bialitate, r\u0103spuns la pl\u00e2ngeri \u0219i abordare bazat\u0103 pe risc<\/span>. Stadiul \u00eendeplinirii acestor Controale se\nrevizuie\u0219te \u00een cadrul fiec\u0103rui audit de evaluare a nivelului de asigurare.<\/span><\/p>\n\n

Art. 2 –\nCon\u021binutul Controalelor<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Con\u021binutul <\/span>integral <\/span>al <\/span>C<\/span>ontroalelor, <\/span>cuprinz\u00e2nd, <\/span>pentru <\/span>fiecare <\/span>Control,\n<\/span>codul <\/span>de <\/span>identificare, <\/span>enun\u021bul cerin\u021bei \u0219i ghidul de implem<\/span>entare, este prev\u0103zut \u00een <\/span>continuare,\n\u00een cuprinsul prezentei anexe.<\/span><\/p>\n\n

Art. 3 –\nNivelurile de asigurare<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

(1) Controalele se aplic\u0103 pe trei niveluri de\nasigurare, denumite, \u00een ordinea cresc\u0103toare a rigorii:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

a)  <\/span><\/span>nivelul <\/span>de <\/span>B<\/span>az\u0103, <\/span>care <\/span>cuprinde\n<\/span>Controale <\/span>ap<\/span>licabile\n<\/span>tuturor <\/span>entit\u0103\u021bilor <\/span>\u0219i <\/span>asigur\u0103 <\/span>un <\/span>nivel <\/span>fiabil de protec\u021bie <\/span>prin utilizarea unor tehnologii \u0219i <\/span>procese, \u00een general, deja disponibile;<\/span><\/p>\n\n

b)  <\/span><\/span>nivelul <\/span>Important, <\/span>la <\/span>care <\/span>Controalele <\/span>nivelului <\/span>de <\/span>Baz\u0103 <\/span>sunt <\/span>consolidate <\/span>pentru <\/span>a <\/span>contribui\n<\/span>la reducerea riscurilor cibe<\/span>rnetice\ncunoscute \u0219i la limitarea imp<\/span>actului\natacurilor efectuate de actori de amenin\u021bare cu resurse \u0219i competen\u021be limitate;<\/span><\/p>\n\n

c)  <\/span><\/span>nivelul <\/span>Esen\u021bial,\n<\/span>la <\/span>care <\/span>Controalele <\/span>nivelului <\/span>Im<\/span>portant <\/span>sunt <\/span>consolidate <\/span>suplimentar <\/span>pentr<\/span>u a \u00eendeplini cele\nmai \u00eenalte cerin\u021be de securitate cibernetic\u0103, incluz\u00e2nd caracteristici avansate\nde securitate \u0219i fiind destinate s\u0103 <\/span>reziste\natacurilor cibernetice sofisticate efectuate de actori de amenin\u021bare cu resurse\n\u0219i expertiz\u0103 <\/span>semnificative.<\/span><\/p>\n\n

(2) Nivelurile de asigurare se afl\u0103 \u00een raport de\nincluziune ierarhic\u0103, astfel:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

a)\n <\/span><\/span>nivelul\n <\/span><\/span>Imp<\/span>ortant  <\/span><\/span>cuprinde  <\/span><\/span>toate  <\/span><\/span>Controalele\n <\/span><\/span>aplicabile\n <\/span><\/span>nivel<\/span>ului  <\/span><\/span>de  <\/span><\/span>Baz\u0103,  <\/span><\/span>pre<\/span>cum\n <\/span><\/span>\u0219i<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Controalele\nsuplimentare prev\u0103zute pentru acest nivel;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

b)\n <\/span><\/span>nivelul\n <\/span><\/span>Esen\u021bial\n <\/span><\/span>cuprinde\n <\/span><\/span>toate\n <\/span><\/span>C<\/span>ontroalele  <\/span><\/span>aplicabile  <\/span><\/span>nivelului\n <\/span><\/span>Imp<\/span>ortant,  <\/span><\/span>prec<\/span>um\n <\/span><\/span>\u0219i<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Controalele\nsuplimentare prev\u0103zute pentru acest nivel.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Art. 4 – <\/span><\/b>Controalele \u0219i aplicabilitatea acestora <\/span>sun<\/span>t\nprev\u0103zute \u00een anex\u0103 la prezenta.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

Anex\u0103 la\nAnexa nr. 1<\/span><\/b><\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

GUVERNARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

[GV.OC]\nCONTEXT ORGANIZA\u021aIONAL<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Sunt <\/span>\u00een\u021belese\n<\/span>circumstan\u021bele <\/span>– <\/span>misiunea, <\/span>a\u0219tept\u0103rile <\/span>p\u0103r\u021bilor <\/span>interesate, <\/span>dependen\u021bele <\/span>\u0219i <\/span>cerin\u021bele <\/span>legale, de reglementare \u0219i <\/span>contractuale\n– aferente deciziilor <\/span>organiza\u021biei\nprivind managementul riscului de securitate cibernetic\u0103.<\/span><\/p>\n\n

GV.OC-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Misiunea <\/span>organiza\u021biei <\/span>este <\/span>\u00een\u021beleas\u0103 <\/span>\u0219i <\/span>se <\/span>afl\u0103 <\/span>la <\/span>baza <\/span>managementului <\/span>riscului de <\/span>securitate cibernetic\u0103.<\/span><\/p>\n\n

GV.OC-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Misiunea <\/span>organiza\u021biei <\/span>trebuie <\/span>stabilit\u0103, <\/span>comunicat\u0103 <\/span>\u0219i <\/span>trebuie <\/span>s\u0103 <\/span>constituie <\/span>baza <\/span>pentru <\/span>managementul riscului de securitate\ncibernetic\u0103 sau a informa\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>misiunea <\/span>organiza\u021biei <\/span>este <\/span>clar <\/span>definit\u0103 \u0219i <\/span>comunicat\u0103 \u0219i c\u0103 serve\u0219te drept baz\u0103 pentru gestionarea\nriscurilor de securitate cibernetic\u0103 sau a informa\u021biei. \u00cen\u021belegerea misiunii\ncontribuie la identificarea riscurilor care ar\n<\/span>putea interfera cu atingerea obiectivelor <\/span>strategice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Misiunea or<\/span>ganiza\u021biei ar trebui comunicat\u0103 prin intermediul unor materiale\nprecum declara\u021bii de viziune <\/span>\u0219i <\/span>misiune,\n<\/span>strategii <\/span>de <\/span>servicii\n<\/span>sau <\/span>documente <\/span>de <\/span>marketing.\nAceasta <\/span>contribuie <\/span>la identificarea \u0219i prioritizarea\nriscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Procesele <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>obiectivele <\/span>strategice\n<\/span>ar <\/span>trebui <\/span>dezvoltate\n<\/span>\u021bin\u00e2nd seama <\/span>de <\/span>securitatea cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei. Aceasta <\/span>include\n<\/span>\u00een\u021belegerea <\/span>modului <\/span>\u00een <\/span>car<\/span>e <\/span>riscurile <\/span>pot <\/span>afecta\nopera\u021biunile, activele, persoanele fizice, parteneri<\/span>i sau interesele societ\u0103\u021bii \u00een general.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Necesitatea <\/span>de <\/span>a <\/span>proteja\n<\/span>informa\u021biile <\/span>sensibile, <\/span>inclusiv\n<\/span>datele <\/span>cu <\/span>caracter\n<\/span>personal, <\/span>ar <\/span>trebui evaluat\u0103 pe baza misiunii or<\/span>ganiza\u021biei \u0219i a modului \u00een <\/span>care func\u021bioneaz\u0103 sistemele \u0219i servic<\/span>iile sale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Misiunea <\/span>\u0219i <\/span>procesele <\/span>conexe\n<\/span>ale <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>trebui\n<\/span>revizuite <\/span>periodic, <\/span>de <\/span>exemplu <\/span>anual, pentru a se asigura c\u0103 r\u0103m\u00e2n\nrelevante \u0219i continu\u0103 s\u0103 sprijine un management al riscului eficace.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

P\u0103r\u021bile <\/span>interesate <\/span>interne <\/span>\u0219i <\/span>externe <\/span>s<\/span>unt <\/span>\u00een\u021belese,\n<\/span>iar <\/span>nevoile <\/span>\u0219i <\/span>a\u0219tep<\/span>t\u0103rile <\/span>acestora <\/span>\u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te\nmanagementul riscului de securitate cibernetic\u0103 sunt \u00een\u021belese \u0219i luate \u00een\nconsiderare.<\/span><\/p>\n\n

GV.OC-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie <\/span>s\u0103 <\/span>demonstreze\nc\u0103 <\/span>\u00een\u021belege \u0219i <\/span>ia <\/span>\u00een <\/span>considerare <\/span>nevoile <\/span>\u0219i <\/span>a\u0219tept\u0103rile <\/span>p\u0103r\u021bilor interesate interne \u0219i externe \u00een ceea ce prive\u0219te\nmanagementul riscului de securitate cibernetic\u0103 sau a informa\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 orga<\/span>niza\u021bia\n\u00een\u021belege \u0219i ia \u00een considerare nevoile \u0219i a\u0219tept\u0103rile <\/span>p\u0103r\u021bilor <\/span>interesate <\/span>interne <\/span>\u0219i <\/span>externe <\/span>\u00een <\/span>gestionarea <\/span>riscurilor <\/span>de <\/span>securitate\n<\/span>cibernetic\u0103 <\/span>sau a informa\u021biei.\nAceasta contribuie la alinierea eforturilor de securitate cibernetic\u0103 la\npriorit\u0103\u021bile organiza\u021biei, obliga\u021biile legale \u0219i \u00eencrederea p\u0103r\u021bilor\ninteresate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021bia\nar trebui s\u0103 identifice p\u0103r\u021bile interesate interne cheie, precum angaja\u021bii,\nconducerea superioar\u0103, membri ai consiliului de administra\u021bie sa<\/span>u echivalent \u0219i auditorii interni.\nRolurile, responsabilit\u0103\u021bile <\/span>\u0219i <\/span>a\u0219tept\u0103rile <\/span>acestora <\/span>\u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te\n<\/span>securitatea <\/span>cibernetic\u0103 <\/span>ar <\/span>trebui <\/span>\u00een\u021belese \u0219i documentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar trebui identificate p\u0103r\u021bile\ninteresate externe cheie, inclusiv clien\u021bii, furnizorii, p<\/span>artenerii, autorit\u0103\u021bile de reglementare,\nac\u021bionarii, furnizorii de servicii \u0219i auditorii externi, iar a\u0219tept\u0103rile\nacestora \u00een materie de conformitate, contracte \u0219i protec\u021bia datelor ar trebui\nluate \u00een considerare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Nevoile <\/span>\u0219i <\/span>a\u0219tept\u0103rile <\/span>p\u0103r\u021bilor\n<\/span>interesate <\/span>ar <\/span>trebui\n<\/span>colectate <\/span>prin <\/span>metode\n<\/span>precum <\/span>interviuri, <\/span>sondaje, revizuiri ale contractelor sau\nanalize ale reglement\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste  <\/span>informa\u021bii \n<\/span>ar  <\/span>trebui  <\/span>integrate \n<\/span>\u00een  <\/span>strategia  <\/span>de \n<\/span>management  <\/span>al  <\/span>riscului \n<\/span>de  <\/span>securitate cibernetic\u0103 <\/span>a <\/span>or<\/span>ganiza\u021biei, <\/span>pentru <\/span>asigurare<\/span>a <\/span>alinierii <\/span>cu <\/span>priorit\u0103\u021bile <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>de <\/span>re<\/span>glementare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>stabilite <\/span>canale <\/span>periodice <\/span>de <\/span>comunicare <\/span>pentru <\/span>a <\/span>men\u021bine\n<\/span>p\u0103r\u021bile <\/span>interesate <\/span>informate\n<\/span>\u0219i implicate \u00een chestiuni legate <\/span>de\nsecuritatea cibernetic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>A\u0219tept\u0103rile <\/span>p\u0103r\u021bilor <\/span>interesate <\/span>ar <\/span>tr<\/span>ebui <\/span>revizuite <\/span>\u0219i <\/span>actualizate <\/span>periodic,\n<\/span>\u00een <\/span>special <\/span>atunci <\/span>c\u00e2nd <\/span>apar modific\u0103ri \u00een opera\u021biunil<\/span>e or<\/span>ganiza\u021biei,\ncerin\u021bele legale sau expunerea la risc.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Cerin\u021bele <\/span>legale, <\/span>de <\/span>reg<\/span>lementare <\/span>\u0219i <\/span>contractuale <\/span>privind\n<\/span>securitatea <\/span>cibernetic\u0103 <\/span>sunt <\/span>\u00een\u021belese <\/span>\u0219i gestionate.<\/span><\/p>\n\n

GV.OC-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Cerin\u021bele  <\/span><\/span>legale  <\/span><\/span>\u0219i  <\/span><\/span>de  <\/span><\/span>reglementare\n <\/span><\/span>privind\n <\/span><\/span>securitatea\n <\/span><\/span>cibernetic\u0103\n <\/span><\/span>sau\n <\/span><\/span>a\n <\/span><\/span>informa\u021biei\n <\/span><\/span>trebuie\nidentificate \u0219i implementate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 cerin\u021bele legale, de reglementare \u0219i <\/span>contractuale referitoare <\/span>la <\/span>securitatea <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>sunt <\/span>identificate, <\/span>monit<\/span>orizate <\/span>\u0219i <\/span>implementate.\n\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar <\/span>trebui <\/span>stabilit\n<\/span>un <\/span>proces <\/span>pentru\n<\/span>urm\u0103rirea <\/span>\u0219i <\/span>aplicarea\n<\/span>cer<\/span>in\u021belor <\/span>legale <\/span>\u0219i <\/span>de <\/span>reglementare\nrelevante legate de securitatea cibernetic\u0103 sau a informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aceste <\/span>cerin\u021be <\/span>ar <\/span>trebui <\/span>integrate\n<\/span>\u00een <\/span>toate <\/span>politicile, <\/span>procedurile <\/span>\u0219i <\/span>practicile <\/span>opera\u021bionale <\/span>relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Domeniile care ar trebui acoperite includ, dar nu se\nlimiteaz\u0103 <\/span>la:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluarea\nriscurilor \u0219i protec\u021bia sistemelor infor<\/span>matice;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>R\u0103spunsul la incidente, continuitatea\nactivit\u0103\u021bii \u0219i managementul crizelor; <\/span>o <\/span><\/span>Securitatea lan\u021bului de aprovizionare \u0219i de<\/span>zvoltarea de sisteme securizate; <\/span>o <\/span><\/span>Managementul vulnerabilit\u0103\u021bilor \u0219i\nconfigurarea securizat\u0103;<\/span><\/p>\n\n

o <\/span><\/span>Con\u0219tientizarea\n\u0219i instruirea \u00een materie de securita<\/span>te;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103suri\nde control criptografic \u0219i co<\/span>munica\u021bii\nsecurizate;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sisteme\nde comunicare de ur<\/span>gen\u021b\u0103;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Controlul\naccesului, managementul activelor \u0219i autenti<\/span>ficarea\nmultifactor (MF<\/span>A);<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Divulgarea <\/span>coordonat\u0103 <\/span>a vulnerabilit\u0103\u021bilor (CVD).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obliga\u021biile legale, de reglementare\n\u0219i contractuale legate de securitatea cibernetic\u0103 sau a informa\u021biei trebuie <\/span>gestionate <\/span>\u00een <\/span>mod <\/span>continuu\n<\/span>pentru <\/span>a <\/span>se <\/span>asigura <\/span>c\u0103 <\/span>aces<\/span>tea <\/span>r\u0103m\u00e2n <\/span>corecte,\n<\/span>actualizate <\/span>\u0219i <\/span>aplicate \u00een mod eficace.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>cerin\u021bele <\/span>legale <\/span>\u0219i <\/span>de <\/span>reglementare <\/span>legate <\/span>de <\/span>securitatea cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>sunt <\/span>gestionate <\/span>\u00een <\/span>mod <\/span>continuu,\n<\/span>actualizate <\/span>\u0219i <\/span>aplicate <\/span>\u00een <\/span>mod <\/span>eficace\n\u00een cadrul organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>un <\/span>proces <\/span>structurat <\/span>pentru <\/span>gestionarea <\/span>continu\u0103\n<\/span>a cerin\u021belor <\/span>legale <\/span>\u0219i <\/span>de\nreglementare legate de securitatea cibernetic\u0103 sa<\/span>u a informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste  <\/span><\/span>cerin\u021be  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>documentate,  <\/span>revizuite  <\/span><\/span>periodic  <\/span><\/span>\u0219i  <\/span><\/span>actualizate  <\/span><\/span>pentru  <\/span>a  <\/span><\/span>reflecta modific\u0103rile <\/span>legisla\u021biei \u0219i reglement\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Abordarea <\/span>or<\/span>ganiza\u021biei <\/span>\u00een <\/span>materie <\/span>de <\/span>conformitate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>clar <\/span>definit\u0103, <\/span>incluz\u00e2nd\n<\/span>rolurile, responsabilit\u0103\u021bile <\/span>\u0219i <\/span>r\u0103spunderea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>implementate <\/span>mecanisme\n<\/span>pentr<\/span>u <\/span>monitorizarea <\/span>modific\u0103rilor <\/span>din <\/span>peisajul <\/span>le<\/span>gislativ <\/span>\u0219i de <\/span>reglementare. <\/span>Astfel\n<\/span>de <\/span>modific\u0103ri <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>declan\u0219eze <\/span>o <\/span>revizuire <\/span>a <\/span>politic<\/span>ilor<\/span>, <\/span>procedurilor \u0219i controalelor relevante\npentru asigurarea conformit\u0103\u021bii continue.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dovezile <\/span>pri<\/span>vind <\/span>activit\u0103\u021bile <\/span>de <\/span>conformitate <\/span>ar <\/span>trebui <\/span>men\u021binute\n<\/span>pentru <\/span>a <\/span>sprijini\n<\/span>auditurile <\/span>\u0219i pentru a\ndemonstra due diligence.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivele,\ncapabilit\u0103\u021bile \u0219i serviciile criti<\/span>ce\nde care depind sau pe care le a\u0219teapt\u0103 p\u0103r\u021bile interesate externe de la\norganiza\u021bie <\/span>sunt \u00een\u021belese \u0219i\ncomunicate.<\/span><\/p>\n\n

GV.OC-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 identifice,\ns\u0103 documenteze \u0219i s\u0103 comunice obiectivele, capabilit\u0103\u021bile \u0219i serviciile <\/span>critice\n<\/span>pe <\/span>care <\/span>se <\/span>bazeaz\u0103 <\/span>p\u0103r\u021bile\n<\/span>interesate <\/span>externe, <\/span>s\u0103 <\/span>le <\/span>prioritizeze <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>criticitate\n\u0219i s\u0103 integreze aceast\u0103 prioritizare \u00een <\/span>procesul\nde evaluare a riscurilor.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 <\/span>organiza\u021bia\n\u00een\u021belege care servicii, capabilit\u0103\u021bi \u0219i obiective critice sunt esen\u021biale pentru\np\u0103r\u021bile interesate externe, le prioritizeaz\u0103 \u00een func\u021bie de importan\u021b\u0103 \u0219<\/span>i le include \u00een procesul <\/span>de evaluare a riscurilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar <\/span>trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Acest Control se concentreaz\u0103 pe ceea\nce or<\/span>ganiza\u021bia ofer\u0103 altora, cu alte\ncuvinte, serviciile \u0219i func\u021biile <\/span>de <\/span>care <\/span>depind <\/span>p\u0103r\u021bile <\/span>interesate <\/span>externe <\/span>(lan\u021bul\nde <\/span>aprovizionare <\/span>din <\/span>aval, <\/span>precum clien\u021bii, partenerii sau\nutilizatorii finali).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Serviciile critice \u0219i func\u021biile interne c<\/span>are le sus\u021bin ar trebui identificate \u00een\nmod clar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>definite <\/span>criterii\n<\/span>pentru <\/span>a <\/span>determina <\/span>importan\u021ba <\/span>fiec\u0103rui <\/span>serviciu\n<\/span>sau <\/span>capabilitate, <\/span>at\u00e2t <\/span>din\nperspectiv\u0103 <\/span>intern\u0103, <\/span>c\u00e2t <\/span>\u0219i <\/span>extern\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>O analiz\u0103 a impactului asupra\nactivit\u0103\u021bii (BIA) poate contribui la identificarea activelor \u0219i opera\u021biunilo<\/span>r <\/span>vitale <\/span>pentru <\/span>atingerea <\/span>obiectivelor cheie <\/span>\u0219i <\/span>a <\/span>consecin\u021belor <\/span>\u00een <\/span>cazul \u00een <\/span>care <\/span>acestea\nar fi <\/span>\u00eentrerupte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Obiectivele de <\/span>rezilien\u021b\u0103, <\/span>cum <\/span>ar <\/span>fi\nviteza <\/span>cu <\/span>care <\/span>serviciile <\/span>critice <\/span>trebuie <\/span>recuperate\n<\/span>\u00een <\/span>timpul perturb\u0103rilor<\/span>, ar trebui stabilite \u0219i comunicate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-04.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 defineasc\u0103 \u0219i\ns\u0103 document<\/span>eze cerin\u021bele de securitate\ncibernetic\u0103 pentru opera\u021biunile esen\u021biale, s\u0103 le <\/span>valideze pr<\/span>in teste \u0219i\naudituri, s\u0103 men\u021bin\u0103 \u00eenregistr\u0103ri ale rezultatelor \u0219i m\u0103surilor corective \u0219i s\u0103\nact<\/span>ualizeze periodic cerin\u021bele \u00een\nfunc\u021bie de evolu\u021bia riscurilor.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 opera\u021biunile esen\u021biale sunt p<\/span>rotejate\nprin m\u0103suri de securitate <\/span>clar <\/span>definite\n<\/span>\u0219i <\/span>testate <\/span>\u0219i <\/span>c\u0103 <\/span>aceste\n<\/span>m\u0103suri <\/span>r\u0103m\u00e2n <\/span>eficace\n<\/span>\u0219i <\/span>actualizate <\/span>pe <\/span>m\u0103sur\u0103 <\/span>ce <\/span>riscurile\nevolueaz\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea \u0219i documentarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Definirea <\/span>serviciilor <\/span>criti<\/span>ce <\/span>\u0219i <\/span>a <\/span>dependen\u021belor <\/span>acestora <\/span>(de <\/span>exemplu,\n<\/span>sisteme, <\/span>furnizori) <\/span>printr- o evaluare structurat\u0103 a\nriscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documentarea  <\/span><\/span>cerin\u021belor  <\/span><\/span>de  <\/span><\/span>securitate  <\/span><\/span>\u0219i  <\/span><\/span>opera\u021bionale,\n <\/span><\/span>inclusiv\n <\/span><\/span>a\n <\/span><\/span>cerin\u021belor\n <\/span><\/span>specifice\nreglement\u0103rilor \u0219i domeniului (de <\/span>exemplu,\nCyFun\u00ae, ISO\/IEC 27001, IEC 62443).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>alidarea \u0219i aprobarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea <\/span>proceselor <\/span>de <\/span>guvernan\u021b\u0103 <\/span>pentru <\/span>revizuirea <\/span>\u0219i <\/span>aprobarea <\/span>cerin\u021belor <\/span>de <\/span>securitate\nidentificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Atribuirea  <\/span><\/span>r\u0103spunderii\n <\/span><\/span>p\u0103r\u021bilor\n <\/span><\/span>interesate\n <\/span><\/span>relevante\n <\/span><\/span>(de\n <\/span><\/span>exemplu,\n <\/span><\/span>echipele\n <\/span><\/span>de\n <\/span><\/span>securitate,\nresponsabilii cu conformitatea, conducerea superioar\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea <\/span>\u0219i <\/span>asigurarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea d<\/span>e\nteste de penetrare, evalu\u0103ri ale vulnerabilit\u0103\u021bilor \u0219i simul\u0103ri de incidente\npentru a valida implementarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea <\/span>efectu\u0103rii <\/span>de <\/span>audituri <\/span>pentru <\/span>ev<\/span>alua<\/span>rea <\/span>eficacit\u0103\u021bii <\/span>\u0219i <\/span>identificarea <\/span>lacunelor\n<\/span>\u00een m\u0103surile de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implementarea <\/span>unor <\/span>m\u0103suri <\/span>corective <\/span>\u00een <\/span>cazul <\/span>\u00een <\/span>care <\/span>sunt <\/span>constatate <\/span>deficien\u021be, <\/span>asigur\u00e2nd \u00eembun\u0103t\u0103\u021birea continu\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>P\u0103strarea \u00eenregistr\u0103rilor \u0219i conformitatea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Men\u021binerea <\/span>unei <\/span>documenta\u021bii <\/span>detaliate <\/span>a <\/span>procedurilor <\/span>de <\/span>testare, <\/span>a <\/span>rezultatelor<\/span>, <\/span>a <\/span>aprob\u0103rilor \u0219i a m\u0103surilor corective.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Alinierea <\/span>cadrelor <\/span>de <\/span>securitate <\/span>la <\/span>obli<\/span>ga\u021biile\n<\/span>de <\/span>reglementare <\/span>pentru <\/span>asigurarea <\/span>conformit\u0103\u021bii \u0219i supravegherea\nguvernan\u021bei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i adaptarea continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Reevaluarea <\/span>periodic\u0103 <\/span>a <\/span>cerin\u021belor <\/span>ca <\/span>r\u0103spuns <\/span>la <\/span>amenin\u021b\u0103rile, <\/span>incidentele <\/span>\u0219i <\/span>modific\u0103rile <\/span>de reglementare \u00een continu\u0103 evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea  <\/span> <\/span><\/span>faptului  <\/span> <\/span><\/span>c\u0103 \n<\/span> <\/span><\/span>or<\/span>ganismele  <\/span> <\/span><\/span>de \n<\/span> <\/span><\/span>guvernan\u021b\u0103  <\/span> <\/span><\/span>supravegheaz\u0103  <\/span> <\/span><\/span>actualiz\u0103rile  <\/span> <\/span><\/span>\u0219i \u00eembun\u0103t\u0103\u021birile pentru men\u021binerea\nrezilien\u021bei cibernetice pe termen lung.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-04.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Redundan\u021ba trebuie implementat\u0103\npentru a \u00eendeplini cerin\u021bele de disponibilitate definite de organiza\u021bie, <\/span>legisla\u021bie \u0219i\/sau reglement\u0103ri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura dispon<\/span>ibilitatea sistemelor\n\u0219i serviciilor critice prin implementarea redundan\u021bei \u00een conformitate cu\ncerin\u021bele organiza\u021bionale, legale \u0219i de reglementare privind disponibilitatea.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele<\/span>:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Acest <\/span>Control <\/span>se <\/span>concentreaz\u0103 <\/span>pe <\/span>asigurarea <\/span>continuit\u0103\u021bii <\/span>func\u021bion\u0103rii <\/span>serviciilor <\/span>esen\u021biale,\n<\/span>chiar \u0219i \u00een cazul \u00een care o parte a sistemului se defecteaz\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Redundan\u021ba <\/span>ar <\/span>trebui <\/span>integrat\u0103 <\/span>\u00een <\/span>componente <\/span>cheie, <\/span>precum <\/span>stocarea\n<\/span>datelor<\/span>, <\/span>infrastructura <\/span>de re\u021b<\/span>ea \u0219i sistemele\ncritice. Exemplele includ:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Servere <\/span>de <\/span>rezerv\u0103, <\/span>echilibratoare <\/span>de <\/span>sarcin\u0103, <\/span>matrice\n<\/span>redundante <\/span>de <\/span>discuri\n<\/span>independente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(RAID)\n\u0219i centre de date multiple;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conexiuni\ninternet de tip failover \u0219i mai mul\u021bi furnizori de servicii de internet (ISP).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Echipamentele <\/span>\u0219i <\/span>serviciile <\/span>critice <\/span>ar <\/span>tr<\/span>ebui <\/span>protejate\n<\/span>\u00eemp<\/span>otriva <\/span>\u00eentreruperilor <\/span>de <\/span>curent <\/span>\u0219i <\/span>a\n\u00eentreruperilor de utilit\u0103\u021bi folosind:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Surse <\/span>de <\/span>alimentare <\/span>ne\u00eentreruptibil\u0103 <\/span>(UPS), <\/span>generatoare <\/span>de <\/span>rezerv\u0103 <\/span>\u0219i <\/span>cabluri <\/span>de <\/span>alimentare\nredundante, <\/span>2 furnizori diferi\u021bi de\nservicii de alimentare cu ener<\/span>gie\nelectric\u0103;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Contracte\nde <\/span>testare \u0219i mentenan\u021b\u0103 periodic\u0103\npentru asigurarea fiabilit\u0103\u021bii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-04.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivele timpului de\nrecuperare (RTO) \u0219i obiectivele punctului de recuperare (RPO) pentru reluarea\nproceselor e<\/span>s<\/span>en\u021biale ale sistemelor de tehnologia informa\u021biei \u0219i\ncomunica\u021biilor (TIC)\/tehnologie opera\u021bional\u0103 (OT) trebuie s\u0103 fie definite \u0219i\nmonitorizate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 organiza\u021bia define\u0219te \u0219i monitorizeaz\u0103 obie<\/span>ctive clare privind RTO \u0219i RPO <\/span>pentru restabilirea proc<\/span>eselor esen\u021biale ale sistemelor TIC \u0219i OT\ndup\u0103 o \u00eentrerupere.<\/span><\/p>\n\n

Pentru <\/span>definirea\n<\/span>\u0219i <\/span>monitorizarea <\/span>RT<\/span>O-urilor <\/span>\u0219i <\/span>R<\/span>PO-urilor\n<\/span>pentru <\/span>sistemele <\/span>TIC\/OT <\/span>critice, <\/span>ar <\/span>trebui\nluate \u00een considerare urm\u0103toarele elemente:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Guvernan\u021b\u0103 <\/span>\u0219i <\/span>definirea <\/span>politicilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea\nunor politici formale \u0219i a r\u0103spunderii pentru definirea \u0219i monitorizarea R<\/span>T<\/span>O\/RPO.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Alinierea <\/span>obiectivelor <\/span>de <\/span>recuperare <\/span>la <\/span>cadrele <\/span>de <\/span>continuitate <\/span>a <\/span>activit\u0103\u021bii <\/span>\u0219i <\/span>de <\/span>recuperare\n<\/span>\u00een caz de dezastru (de exemplu, ISO 22301, ISO\/IEC 27031).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea\nimplic\u0103rii conducerii \u0219i a conformit\u0103\u021bii <\/span>cu\ncerin\u021bele de reglementare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>BIA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea <\/span>interdependen\u021belor <\/span>dintre\n<\/span>sistemele <\/span>TIC <\/span>\u0219i <\/span>OT<\/span>, <\/span>precum <\/span>\u0219i <\/span>a <\/span>efectelor <\/span>lor <\/span>\u00een cascad\u0103\nasupra opera\u021biunilor or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Determinarea\npragurilor acceptabile de nefunc\u021bionare pentru diferite categorii de sisteme.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea riscurilor \u0219i amenin\u021b\u0103rilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea  <\/span><\/span>unor  <\/span><\/span>simul\u0103ri  <\/span><\/span>de  <\/span><\/span>amenin\u021b\u0103ri  <\/span><\/span>din  <\/span><\/span>lumea\n <\/span><\/span>real\u0103\n <\/span><\/span>(de\n <\/span><\/span>exemplu,\n <\/span><\/span>exerci\u021bii\n <\/span><\/span>de\n <\/span><\/span>tip\nransomware, testare la stres pentru at<\/span>acuri <\/span>DDoS).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Integrarea <\/span>informa\u021biilor <\/span>privind\n<\/span>amenin\u021b\u0103rile <\/span>\u00een <\/span>planificarea <\/span>recuper\u0103rii <\/span>pentru <\/span>anticiparea riscurilor \u00een evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Clasificarea \u0219i prioritizarea sistemelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Definirea <\/span>unor <\/span>strategii <\/span>de <\/span>recuperare <\/span>pe <\/span>niveluri, <\/span>\u00een <\/span>func<\/span>\u021bie <\/span>de <\/span>impactul\n<\/span>asupra <\/span>activit\u0103<\/span>\u021bii <\/span>(de\nexemplu, Nivelul 1 = restaurare imediat\u0103, Nivelul 2 = recuperare \u00eent\u00e2rziat\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea <\/span>mecanismelor <\/span>de <\/span>failover <\/span>pentru <\/span>proce<\/span>sele <\/span>OT <\/span>critice <\/span>care <\/span>trebuie <\/span>s\u0103 <\/span>func\u021bioneze continuu.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Strategii de <\/span>backup\n\u0219i re<\/span>cuperare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implementarea\nde backup-uri imuabile pentru protec\u021bie \u00eempotriva ransomware<\/span>-ului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea  <\/span><\/span>op\u021biunilor\n <\/span><\/span>de\n <\/span><\/span>recuperare\n <\/span><\/span>la\n <\/span><\/span>o\n <\/span><\/span>loca\u021bie\n <\/span><\/span>extern\u0103\n <\/span><\/span>\u0219i\n <\/span><\/span>\u00een\n <\/span><\/span>cloud\n <\/span><\/span>pentru\n <\/span><\/span>rezilien\u021b\u0103\ngeografic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea <\/span>verific\u0103rilor <\/span>period<\/span>ice <\/span>de <\/span>validare <\/span>\u0219i <\/span>integritate <\/span>ale <\/span>backup<\/span>-urilor\n<\/span>pentru <\/span>prevenirea e\u0219ecurilor\n\u00een timpul recuper\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea \u0219i validarea obiectivelor de\n<\/span>recuperare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea <\/span>testelor\n<\/span>de <\/span>recuperare <\/span>\u00een <\/span>caz\nde <\/span>dezastru (exerci\u021bii <\/span>teoretice, <\/span>exerci\u021bii <\/span>de <\/span>restaurare complet\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103surarea <\/span>eficacit\u0103\u021bii <\/span>R<\/span>T<\/span>O\/RPO <\/span>prin <\/span>monitorizare <\/span>\u00een <\/span>timp <\/span>real <\/span>\u0219i <\/span>simul\u0103ri\n<\/span>d<\/span>e <\/span>r\u0103spuns <\/span>la\nincidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea\nunei coordon\u0103ri automate a re<\/span>cuper\u0103rii\npentru accelerarea relu\u0103rii serviciilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea continu\u0103 \u0219i \u00eembun\u0103t\u0103\u021birea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea\n <\/span><\/span>de\n <\/span><\/span>analize\n <\/span><\/span>\u00een\n <\/span><\/span>timp\n <\/span><\/span>real\n <\/span><\/span>pentru\n <\/span><\/span>evaluarea\n <\/span><\/span>abaterilor\n <\/span><\/span>de\n <\/span><\/span>la\n <\/span><\/span>valorile\n <\/span><\/span>R<\/span>T<\/span>O\/RPO<\/span><\/p>\n\n

 <\/span><\/p>\n\n

preconizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Adaptarea\nobiectivelor d<\/span>e recuperare <\/span>pe baza lec\u021biilor \u00eenv\u0103\u021bate din incidente\n\u0219i audituri.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rezultatele, capabilit\u0103\u021bile \u0219i serviciile de care de<\/span>pinde organiza\u021bia sunt \u00een\u021belese \u0219i\ncomunicate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV.OC-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s<\/span>\u0103 <\/span>identifice, <\/span>s\u0103 <\/span>documenteze <\/span>\u0219i <\/span>s\u0103 <\/span>comunice\n<\/span>rolul <\/span>s\u0103u <\/span>\u00een <\/span>lan\u021bul <\/span>de <\/span>aprovizionare,\ninclusiv <\/span>capabilit\u0103\u021bile <\/span>externe, <\/span>servic<\/span>iile <\/span>\u0219i <\/span>dependen\u021bele <\/span>de <\/span>care <\/span>depinde (din <\/span>amonte), <\/span>precum <\/span>\u0219i interac\u021biunile sale cu p\u0103r\u021bile\ninteresate din aval.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>organiza\u021bia <\/span>identific\u0103, <\/span>documenteaz\u0103 <\/span>\u0219i <\/span>comunic\u0103\n<\/span>rolul s\u0103u \u00een cadrul lan\u021bului de aprovizionare, prin \u00een\u021belegerea\ncapabilit\u0103\u021bilor, serviciilor \u0219i dependen\u021belor externe pe care se bazea<\/span>z\u0103 (din amonte), recunosc\u00e2nd \u00een acela\u0219i\ntim<\/span>p interac\u021biunile sale cu p\u0103r\u021bile\ninteresate din aval.<\/span><\/p>\n\n

Acest Control se\nconcentreaz\u0103 \u00een principal pe lan\u021bul de aprovizionare din amonte, respectiv\nasupra elementelor de care orga<\/span>niza\u021bia\ndepinde din partea altor entit\u0103\u021bi, men\u021bin\u00e2nd \u00een acela\u0219i timp alinierea cu <\/span>GV.OC-04, <\/span>care <\/span>abordeaz\u0103 <\/span>ceea <\/span>ce <\/span>organiza\u021bia <\/span>furnizeaz\u0103 <\/span>altor <\/span>entit\u0103\u021bi. <\/span>\u00cempreun\u0103, <\/span>acestea <\/span>ofer\u0103\n<\/span>o imagine complet\u0103 a dependen\u021belor \u0219i responsabilit\u0103\u021bilor lan\u021bului de\naprovizionare.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een <\/span>considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Rolul <\/span>or<\/span>ganiza\u021biei <\/span>\u00een <\/span>lan\u021bul <\/span>de <\/span>aprovizionare <\/span>ar <\/span>tr<\/span>ebui <\/span>definit <\/span>\u00een <\/span>mod <\/span>clar<\/span>, <\/span>prin <\/span>includerea <\/span>at\u00e2t <\/span>a\nceea <\/span>ce <\/span>este <\/span>livrat <\/span>altor <\/span>p\u0103r\u021bi <\/span>(din <\/span>aval), <\/span>c\u00e2t <\/span>\u0219i <\/span>a <\/span>ceea <\/span>ce <\/span>este <\/span>primit <\/span>din <\/span>surse <\/span>externe <\/span>(di<\/span>n <\/span>amonte).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dependen\u021bele <\/span>de <\/span>resurse\n<\/span>ex<\/span>terne <\/span>– <\/span>precum <\/span>incintele, <\/span>furnizorii <\/span>de <\/span>servicii\n<\/span>cloud <\/span>\u0219i <\/span>fur<\/span>nizorii <\/span>de servicii, produse sau capabilit\u0103\u021bi <\/span>– ar trebui identificate \u0219i documentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste <\/span>dependen\u021be <\/span>ar <\/span>trebui <\/span>corelate\n<\/span>cu <\/span>func\u021biile <\/span>opera\u021bionale <\/span>conexe <\/span>\u0219i <\/span>cu <\/span>activele <\/span>or<\/span>ganiza\u021biei\npentru a \u00een\u021belege impactul lor asupra opera\u021biunilo<\/span>r<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>O <\/span>aten\u021bie <\/span>deosebit\u0103\n<\/span>ar <\/span>trebui <\/span>acordat\u0103\n<\/span>dependen\u021belor <\/span>ex<\/span>terne <\/span>care <\/span>reprezint\u0103 <\/span>poten\u021biale <\/span>puncte <\/span>de e\u0219ec pentru serviciile sa<\/span>u capabilit\u0103\u021bile critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste  <\/span><\/span>informa\u021bii  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>comunicate\n <\/span><\/span>personalului\n <\/span><\/span>relevant\n <\/span><\/span>\u0219i\n <\/span><\/span>p\u0103r\u021bilor\n <\/span><\/span>interesate\n <\/span><\/span>pentru\nsprijinirea managementului riscului, a planific\u0103rii conti<\/span>nuit\u0103\u021bii \u0219i a coordon\u0103rii r\u0103spunsului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar <\/span>trebui <\/span>stabilite\n<\/span>canale <\/span>de <\/span>comunicare\n<\/span>pentru <\/span>a <\/span>se <\/span>asigura <\/span>c\u0103 <\/span>rolurile <\/span>\u0219i <\/span>dependen\u021bele <\/span>din <\/span>lan\u021bul\nde aprovizionare sunt \u00een\u021belese \u00een <\/span>mod\nclar \u00een cadrul or<\/span>ganiza\u021biei \u0219i de\nc\u0103tre partenerii cheie.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[GV.RM]\nSTRATEGIA DE MANAGEMENT AL RISCULUI<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Priorit\u0103\u021bile, <\/span>constr\u00e2ngerile, <\/span>declara\u021biile <\/span>privind <\/span>toleran\u021ba\n<\/span>\u0219i <\/span>apetitul <\/span>pentru <\/span>risc <\/span>ale <\/span>organiza\u021biei, <\/span>precum \u0219i ipotezele sunt stabilite,\ncomunica<\/span>te \u0219i utilizate pentru\nsprijinirea deciziilor privind riscurile opera\u021bionale<\/span>.<\/span><\/p>\n\n

GV.RM-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivele <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>sunt <\/span>stabilite <\/span>\u0219i <\/span>convenite <\/span>de <\/span>p\u0103r\u021bile <\/span>interesate <\/span>ale <\/span>organiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivele <\/span>privind <\/span>securitatea <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>in<\/span>forma\u021biei <\/span>trebuie <\/span>identificate, <\/span>convenite\n<\/span>de <\/span>p\u0103r\u021bile interesate ale\norganiza\u021bi<\/span>ei \u0219i apr<\/span>obate de conducerea superioar\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Respectarea principiilor de mana<\/span>gement al riscului descrise \u00een ISO\/IEC\n27005, care ofer\u0103 recomand\u0103ri privind identificarea, evaluarea \u0219i atenuarea <\/span>riscurilor de securitate a informa\u021biei.\nMai exact:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Clauza\n6.1 ar trebui utilizat\u0103 pentru stabilirea unu<\/span>i\nproces structurat de evaluare a risc<\/span>urilor;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Clauza\n6.3 ar trebui s\u0103 ghideze definirea strategiilor adecvate de tratare a riscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Actualizarea <\/span>obiectivelor <\/span>pe <\/span>terme<\/span>n <\/span>scurt <\/span>\u0219i <\/span>lung <\/span>\u00een <\/span>materie\n<\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a informa\u021biei \u00een\ncadrul planific\u0103rii strategice anuale \u0219i ca r\u0103sp<\/span>uns <\/span>la modific\u0103rile or<\/span>ganiza\u021bionale majore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cen or<\/span>ganiza\u021biile\ndin sectorul OT<\/span>, conducerea\nsuperioar\u0103 ar trebui s\u0103 ia \u00een considerare factorii de s\u0103n\u0103tate, siguran\u021b\u0103 \u0219i me<\/span>diu atunci c\u00e2nd identific\u0103 <\/span>riscurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Stabilirea  <\/span>unor \n<\/span>obiecti<\/span>ve  <\/span>specifice,  <\/span><\/span>m\u0103surabile,  <\/span>realizabile, \n<\/span>relevante  <\/span>\u0219i  <\/span>\u00eencadrate \n<\/span>\u00een  <\/span>timp (SMAR<\/span>T) pentru securit<\/span>atea cibernetic\u0103 sau a informa\u021biei (de exemplu, \u00eembun\u0103t\u0103\u021birea\ncalit\u0103\u021bii instruirii utilizatorilor<\/span>,\nasigurarea unei protec\u021bii adecvate pentru sistemele de control industrial <\/span>– ICS).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizarea <\/span>acestor <\/span>obiective <\/span>pentru m\u0103surarea <\/span>\u0219i <\/span>gestionarea <\/span>riscului\n<\/span>\u0219i <\/span>performan\u021b<\/span>ei <\/span>\u00een <\/span>cadrul or<\/span>ganiza\u021biei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Declara\u021biile privind apetitul pentru risc \u0219i toleran\u021ba\nla risc sunt stabilite, comunicate \u0219i men\u021binute.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Declara\u021biile <\/span>priv<\/span>ind <\/span>apetitul\n<\/span>pentru <\/span>ri<\/span>sc <\/span>\u0219i <\/span>toleran\u021ba\n<\/span>la <\/span>risc <\/span>trebuie <\/span>definite, <\/span>documentate, <\/span>aprobate <\/span>de conducerea\nsuperioar\u0103, comunicate \u0219i men\u021binute.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>GV.RM-02.1 <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>organiza\u021bia <\/span>are <\/span>o <\/span>\u00een\u021belegere <\/span>clar\u0103 <\/span>\u0219i <\/span>aplicabil\u0103 <\/span>a <\/span>limi<\/span>telor sale <\/span>de <\/span>risc, <\/span>ceea <\/span>ce <\/span>ajut\u0103\n<\/span>la <\/span>orientarea <\/span>procesului <\/span>decizional <\/span>\u0219i <\/span>a <\/span>practicilor <\/span>de <\/span>management <\/span>al <\/span>riscului.\n\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Apetitul <\/span>pentru <\/span>risc <\/span>reprezint\u0103 <\/span>cantitatea <\/span>\u0219i <\/span>tipul <\/span>de <\/span>risc <\/span>pe <\/span>care <\/span>o <\/span>or<\/span>ganiza\u021bie <\/span>este <\/span>dispus\u0103 <\/span>s\u0103 <\/span>le\nasume sau s<\/span>\u0103 le accepte \u0219i are\ncaracter strategic\/calitativ (sursa: ISO\/IEC\n<\/span>27005).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>oleran\u021ba <\/span>la risc <\/span>reprezi<\/span>nt\u0103 <\/span>abaterea <\/span>acceptabil\u0103 <\/span>de <\/span>la <\/span>nivelul <\/span>stabilit <\/span>prin <\/span>apetitul <\/span>pentru risc <\/span>\u0219i obiectivele or<\/span>ganiza\u021biei <\/span>\u0219i are caracter tactic\/cantitativ (sursa<\/span>: ISACA).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Apetitul <\/span>pentru <\/span>risc <\/span>al <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>seama <\/span>de <\/span>rolul <\/span>s\u0103u <\/span>\u00een <\/span>infrastructura <\/span>critic\u0103 <\/span>\u0219i\n\u00een sectorul s\u0103u.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021biile <\/span>din <\/span>sectorul <\/span>OT <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>seam<\/span>a <\/span>de <\/span>priorit\u0103\u021bile <\/span>\u00een <\/span>materie <\/span>de <\/span>s<\/span>\u0103n\u0103tate, siguran\u021b\u0103 \u0219i mediu \u00een definirea\napetitului lor pentru risc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Declara\u021biile <\/span>privind <\/span>apetitul <\/span>pentr<\/span>u <\/span>risc <\/span>ar <\/span>trebui <\/span>traduse <\/span>\u00een <\/span>declara\u021bii <\/span>specifice, <\/span>m\u0103surab<\/span>ile <\/span>\u0219i <\/span>u\u0219or\nde \u00een\u021beles privind toleran\u021ba la risc (S<\/span>MAR<\/span>T).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Obiectivele <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>apetitul <\/span>pentru\n<\/span>risc <\/span>ar <\/span>trebui <\/span>ajustate <\/span>periodic\n<\/span>pe <\/span>baza <\/span>expunerii cunoscute la riscuri \u0219i a riscului rezidual.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Cu A<\/span>wareness <\/span>Raising\n<\/span>in <\/span>a <\/span>Box <\/span>(AR<\/span>-in-a-Box), Agen\u021bia <\/span>Uniunii <\/span>Eu<\/span>ropene\n<\/span>pentru <\/span>Securitate Cibernetic\u0103\n(ENISA) ofer\u0103 or<\/span>ganiza\u021biilor\ninstrumentele \u0219i resurse<\/span>le esen\u021biale\npentru cre\u0219terea \u00een mod <\/span>eficace <\/span>a <\/span>gradului <\/span>de <\/span>con\u0219tientizare <\/span>cu <\/span>privire <\/span>la <\/span>securitatea <\/span>cibernetic\u0103 \u00een <\/span>cadrul opera\u021biunilo<\/span>r <\/span>lor<\/span>. <\/span>Acest\n<\/span>set <\/span>de <\/span>instrum<\/span>ente <\/span>Do<\/span>-It-Y<\/span>ourself\n<\/span>elaborat <\/span>de <\/span>c\u0103tre\n<\/span>ENISA <\/span>con\u021bine <\/span>un <\/span>ghid\nde nivel C.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile \u0219i rezultatele managementului\nriscului de securitate cibernetic\u0103 sunt incluse \u00een procesele de management al\nriscului la nivel de organiza\u021bie (ERM).<\/span><\/p>\n\n

GV.RM-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Ca <\/span>parte <\/span>a <\/span>strategiei\n<\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>la <\/span>nivelul <\/span>\u00eentregii <\/span>organiza\u021bii, <\/span>trebuie <\/span>elabora<\/span>t\u0103 o strategie cuprinz\u0103toare de management\nal riscului de securitate cibernetic\u0103 sau a informa\u021biei, care trebuie\nactualizat\u0103 atunci c\u00e2nd apar modific\u0103ri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest Control se concentreaz\u0103 pe\nelaborarea \u0219i men\u021binerea unei strategii specific<\/span>e de gestionare a riscurilor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei. <\/span>Aceasta\n<\/span>asigur\u0103 c\u0103 <\/span>organiza\u021bia <\/span>dispune\n<\/span>de <\/span>un plan dedicat \u0219i\naplicabil, care <\/span>evolueaz\u0103 odat\u0103 cu\npeisajul amenin\u021b\u0103rilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv<\/span>, ar trebui luate \u00een con<\/span>siderare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>O <\/span>strategie <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>la <\/span>nivelul <\/span>\u00eentregii\n<\/span>or<\/span>ganiza\u021bii <\/span>include\n<\/span>o <\/span>exprimare <\/span>a toleran\u021bei la riscul de securi<\/span>tate pentru or<\/span>ganiza\u021bie, strategii de atenuare a riscurilor de securitate,\nmetodologii <\/span>acceptabile <\/span>de <\/span>evaluare <\/span>a <\/span>riscurilor<\/span>, <\/span>un <\/span>proces <\/span>de <\/span>evaluare <\/span>a <\/span>riscurilor\n<\/span>de <\/span>securitate \u00een <\/span>cadrul <\/span>or<\/span>ganiza\u021biei <\/span>\u00een <\/span>raport <\/span>cu <\/span>toleran\u021ba\nla <\/span>risc a <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>abord\u0103ri <\/span>pentru monitorizarea riscurilor \u00een timp.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Riscurile <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>inform<\/span>a\u021biei <\/span>ar <\/span>trebui <\/span>agregate\n<\/span>\u0219i <\/span>gestionate <\/span>al\u0103turi\n<\/span>de celelalte riscuri ale or<\/span>ganiza\u021biei\n(de exemplu, de conformitate, financiare, opera\u021bionale, de reglementare, de\nreputa\u021bie, de siguran\u021b\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Strategia <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\nidentificarea \u0219i alocarea resurselor necesare pentru prot<\/span>ejarea activelor critice pentru activitatea or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aceasta <\/span>este <\/span>implementarea <\/span>specific\u0103 <\/span>securit\u0103\u021bii <\/span>cibernetice <\/span>a <\/span>viziunii <\/span>mai <\/span>lar<\/span>gi <\/span>definite <\/span>\u00een<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV<\/span>.RM-04.1.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Riscurile <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>trebuie <\/span>documentate, <\/span>ca <\/span>parte <\/span>a <\/span>proceselor <\/span>ERM, aprobate \u00een mod formal de conducerea\nsuperioar\u0103 \u0219i actualizate atunci c\u00e2nd apar modific\u0103ri.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest Control ar trebui\ns\u0103 asigure punerea \u00een <\/span>aplicare a\nstrategiei prin procese structurate. Se concentreaz\u0103 <\/span>pe <\/span>nivelul <\/span>opera\u021bional <\/span>\u0219i <\/span>de <\/span>guvernan\u021b\u0103, <\/span>asigur\u0103 <\/span>r\u0103spunderea <\/span>\u0219i <\/span>trasabilitatea <\/span>riscuril<\/span>or\n\u0219i pune accentul pe procesele formale \u0219i supravegherea.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar tr<\/span>ebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea sistematic\u0103 a riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Obiectiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Identificarea\nproactiv\u0103 a riscurilor de <\/span>securitate\ncibernetic\u0103 sau a informa\u021biei \u00een cadrul or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103suri:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Evalu\u0103ri <\/span>periodice ale riscurilor <\/span>ar <\/span>trebui <\/span>efectuate\n<\/span>u<\/span>tiliz\u00e2nd <\/span>metode <\/span>precum <\/span>modelarea amenin\u021b\u0103rilor<\/span>, ateliere de lucru privind riscurile \u0219i\nscan\u0103ri de vulnerabilit\u0103\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Riscurile <\/span>legate\n<\/span>de <\/span>toate <\/span>activele\n<\/span>digitale <\/span>\u0219i <\/span>fizice\n<\/span>(hardware, <\/span>software, <\/span>date,\n<\/span>re\u021bele<\/span>) <\/span>ar trebui incluse \u00een inventarul activelor<\/span>, \u00eem<\/span>preun\u0103 cu\nmetadatele cheie (l<\/span>oca\u021bie, proprietar<\/span>, utilizare).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Utilizarea\nunor surse precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Jurnale\nde incidente de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Rezultatele\ntestelor de penetrare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Cerin\u021be\nde reglementare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Informa\u021bii\nprivind ameni<\/span>n\u021b\u0103rile din domeniu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>implic\u0103rii <\/span>echipelor\n<\/span>interfunc\u021bionale (tehnologia <\/span>informa\u021biei <\/span>– IT\/OT<\/span>,\njuridic, conformitate, unit\u0103\u021bi or<\/span>ganiza\u021bionale).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumente\nde luat \u00een considerare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>\u0218abloane\nde evaluare a riscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Platforme  <\/span>de \n<\/span>informa\u021bii  <\/span>privind  <\/span>amenin\u021b\u0103rile \n<\/span>(de  <\/span>ex<\/span>emplu,  <\/span>platform\u0103  <\/span>de \n<\/span>schimb  <\/span>de informa\u021bii despre\nmalware <\/span>– MISP<\/span>, Recorded Future).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Inventare\nde active \u0219i diagrame de fluxuri de date.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea riscurilor \u00een cadrul ERM<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Obiectiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Asigurarea\nintegr\u0103rii risc<\/span>urilor de securitate\ncibernetic\u0103 \u00een <\/span>procesul ERM mai\namplu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103suri:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a utiliz\u0103rii <\/span>unui <\/span>registru <\/span>centralizat <\/span>de <\/span>riscuri <\/span>sau <\/span>a <\/span>unui <\/span>instrument\nde guvernan\u021b\u0103, risc \u0219i conformitate (GRC) pentru a documenta:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Descrierea <\/span>riscului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Probabilitatea\n\u0219i impactul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Responsabilul\nde risc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Controale <\/span>existente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Riscul\nrezidual.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Planul\nde tratare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Managemen<\/span>tul <\/span>riscului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>aliniat\n<\/span>la <\/span>obiectiv<\/span>ele strategice ale or<\/span>ganiza\u021biei pentru a asigura releva<\/span>n\u021ba \u0219i sprijinul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumente\nde luat \u00een considerare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Platforme\nG<\/span>RC.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Foi <\/span>de <\/span>calcul\/platforme <\/span>de <\/span>colaborare <\/span>(de <\/span>exemplu, <\/span>Excel\/SharePoint) <\/span>pentru <\/span>or<\/span>ganiza\u021bii mai <\/span>mici.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aprobarea formal\u0103 \u0219i implicarea conducerii superioare\na or<\/span>ganiza\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Obiectiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Asigurarea\nsupravegherii \u0219i a r\u0103spund<\/span>erii\nconducerii <\/span>\u00een luarea dec<\/span>iziilor privind riscurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103suri:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Evalu\u0103rile <\/span>ri<\/span>scurilor <\/span>\u0219i <\/span>planurile <\/span>de <\/span>tr<\/span>ata<\/span>re <\/span>a <\/span>riscurilor <\/span>ar <\/span>trebui <\/span>prezentate <\/span>unui <\/span>Comitet <\/span>de risc sau unui Comitet executiv<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Luarea  <\/span><\/span>\u00een  <\/span><\/span>considerare\n <\/span><\/span>a\n <\/span><\/span>includerii\n <\/span><\/span>riscurilor\n <\/span><\/span>de\n <\/span><\/span>securitate\n <\/span><\/span>cibernetic\u0103\n <\/span><\/span>\u00een\n <\/span><\/span>rapoartele\ntrimestriale de risc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Ar\ntrebui ob\u021binut\u0103 aprobarea formal\u0103 pentru:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Acceptarea\nriscurilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Planuri\nde atenuare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Aloc\u0103rile\nbugetare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumente\nde luat \u00een considerare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>\u0218abloane\npentru raportarea c\u0103tre consiliul de administra\u021bie sau echivalent.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>T<\/span>ablouri de bord privind riscurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Procese-verbale\nale \u0219edin\u021belor cu aprob\u0103ri documentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Comunicare<\/span>a\n\u0219i con\u0219tientizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Obiectiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Asigurarea\ninform\u0103rii \u0219i im<\/span>plic\u0103rii tuturor\np\u0103r\u021bilor interesate relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103suri:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Ar <\/span>trebui <\/span>stabilite <\/span>linii <\/span>clare <\/span>de <\/span>comunicare <\/span>pentru <\/span>riscuril<\/span>e <\/span>de <\/span>securitate <\/span>cibernetic\u0103, inclusiv cele provenite de la furnizori \u0219i p\u0103r\u021bi\nter\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Riscurile\naprobate \u0219i strategiile de atenuare ar treb<\/span>ui\ncomunicate echipelor relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Con\u0219tientizarea <\/span>ar <\/span>trebui <\/span>promovat\u0103 <\/span>prin <\/span>instruire, <\/span>sesiuni\n<\/span>de <\/span>infor<\/span>mare <\/span>\u0219i <\/span>comunic\u0103ri interne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumente\nde luat \u00een considerare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Platforme\nde comunicare intern\u0103 (de <\/span>exemplu, <\/span>T<\/span>eams,\nSlack).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Planuri\nde comunicare a riscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Liste\nale p\u0103r\u021bilor interesate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea continu\u0103 \u0219i actualiz\u0103ri<\/span>le<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Obiectiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Men\u021binerea\nla zi a informa\u021biilor privind riscurile \u0219i adaptarea acestora la modific\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103suri:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Ar <\/span>trebui <\/span>implementat\u0103 <\/span>o <\/span>monitorizare <\/span>continu\u0103\n<\/span>pentru <\/span>a <\/span>detecta\n<\/span>modific\u0103rile <\/span>\u00een <\/span>peisajul amenin\u021b\u0103rilor sau \u00een mediul or<\/span>ganiza\u021bional.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Luarea\n\u00een co<\/span>nsiderare a definirii unor fac<\/span>tori declan\u0219atori pentru actualiz\u0103ri,\nprecum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Noi\namenin\u021b\u0103ri sau vulnerabilit\u0103\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Modific\u0103ri\n\u00een procesele or<\/span>ganiza\u021biei sau \u00een\nsistemele IT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Modific\u0103ri\nale reglement\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Ar <\/span>trebui <\/span>stabilit <\/span>un <\/span>proces <\/span>de <\/span>management <\/span>al <\/span>modific\u0103rilor <\/span>care <\/span>s\u0103 <\/span>includ\u0103\n<\/span>actualiz<\/span>area documenta\u021biei\nprivind securitatea cibernetic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Ar <\/span>trebui <\/span>efectuate <\/span>revizuiri\n<\/span>periodice <\/span>(de <\/span>exemplu, <\/span>trimestrial <\/span>sau <\/span>de <\/span>dou\u0103 <\/span>ori <\/span>pe <\/span>an) <\/span>ale riscurilor documentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumente\nde luat \u00een considerare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sisteme\nde management al modific\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Instrumente\nde monitoriz<\/span>are continu\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Calendare\nde revizuire a riscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest <\/span>Control <\/span>pune <\/span>\u00een <\/span>aplicare <\/span>GV.RM<\/span>-03.1 <\/span>prin <\/span>integrarea <\/span>riscurilor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>\u00een cadrul ERM \u0219i prin asigurarea guvernan\u021bei \u0219i r\u0103spunderii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Direc\u021bia strategic\u0103 care descrie op\u021biunile adecvate de\nr\u0103spuns la riscuri este stabilit\u0103 \u0219i comunicat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Un plan sau o viziune la\nnivel \u00eenalt trebuie s\u0103 fie stabilit \u00een mod formal \u0219i comunicat \u00een mod clar\ntuturor <\/span>persoanelor <\/span>implicate <\/span>cu <\/span>privire <\/span>la <\/span>modul <\/span>de <\/span>gestionare <\/span>a <\/span>riscurilor, <\/span>inclusiv\n<\/span>diferitele <\/span>strategii pe care\norganiza\u021bia le poate utiliza pentru a aborda riscurile identificate, \u00een func\u021bie\nde apetitul pentru risc sau de nivelul de toleran\u021b\u0103 la risc.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>stabili <\/span>fundamentul <\/span>strategic <\/span>pentru <\/span>managementul <\/span>riscului, <\/span>care\ninclude:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>oleran\u021ba la risc \u0219i apetitul pentru ris<\/span>c.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Direc\u021bia strategic\u0103 pentru gestionarea riscurilor (de\nexemplu, atenuarea, transferul, acceptarea).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea ali<\/span>nierii\n\u00eentre departamente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Asigurarea <\/span>faptului <\/span>c\u0103 <\/span>to\u021bi <\/span>membrii <\/span>or<\/span>ganiza\u021biei <\/span>\u00een\u021beleg <\/span>imaginea <\/span>de <\/span>ansamblu <\/span>a <\/span>modului <\/span>\u00een <\/span>care\nsunt abordate \u0219i gestionate riscurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Controlul se concentreaz\u0103 pe:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Managemen<\/span>tul\nriscului la nivel strategic \u0219i or<\/span>ganiza\u021bional.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unei viziuni sau a unui plan formal \u0219i\ncuprinz\u0103tor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Comunicare<\/span>a <\/span>strategiilor <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>(de <\/span>exemplu, <\/span>evitarea,\n<\/span>atenuarea, <\/span>transferul,\nacceptarea).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Se aplic\u0103 tuturor tipurilor de riscuri, nu doar\nsecurit\u0103\u021bii cibernetice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen <\/span>raport <\/span>cu <\/span>Controalele <\/span>GV.RM-03.1, <\/span>GV.RM-03.2 <\/span>\u0219i <\/span>GV.RM-05.1, <\/span>acest <\/span>Control <\/span>reprezint\u0103 <\/span>punctul de plecare; el define\u0219te filosofia organiza\u021biei \u00een\nmaterie de risc, inclusiv apetitul \u0219i toleran\u021ba, care ghideaz\u0103 toate celelalte\nactivit\u0103\u021bi.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Liniile <\/span>de <\/span>comunicare <\/span>\u00een <\/span>cadrul <\/span>organiza\u021biei <\/span>sun<\/span>t <\/span>stabilite\n<\/span>pentru <\/span>riscuril<\/span>e <\/span>de <\/span>securitate\n<\/span>cibernetic\u0103, inclusiv riscurile provenite de la furnizori \u0219i alte p\u0103r\u021bi\nter\u021be.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RM-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru a sprijini viziunea de nivel\n\u00eenalt privind managementul riscului, organiza\u021bia trebuie s\u0103 stabileasc\u0103 <\/span>linii\n<\/span>de <\/span>comunicare <\/span>clare\n<\/span>pentru <\/span>riscurile <\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>inclusiv <\/span>cele <\/span>provenite de la furnizori \u0219i p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>informa\u021biile <\/span>privind\n<\/span>riscurile <\/span>de <\/span>securitate <\/span>cibernetic\u0103 sau a informa\u021biei sunt partajate \u00een mod eficace \u00een\ncadrul o<\/span>rganiza\u021biei \u0219i cu p\u0103r\u021bi\nexterne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest Control axat pe comunicarea\nopera\u021bional\u0103 \u0219i tactic\u0103 este specific riscurilor de securitate cibernetic\u0103 \u0219i\npune accentul pe canalele de <\/span>comunicare\n(de exemplu, raportarea, escaladarea, coordonarea), inclusiv riscurile externe\nprovenite de la furnizori \u0219i p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea rolurilor \u0219i responsabilit\u0103\u021bil<\/span>or \u00een materie de comunicare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Atribuirea <\/span>clar\u0103 <\/span>a <\/span>r\u0103spunderii <\/span>pentru\n<\/span>raportarea, <\/span>escaladarea <\/span>\u0219i <\/span>r\u0103spun<\/span>sul <\/span>la <\/span>riscurile <\/span>de securitate cibernetic\u0103 \u00eentre departamente \u0219i cu p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unor canale de comunicare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>de <\/span>canale <\/span>structurate, <\/span>precu<\/span>m <\/span>grupuri\n<\/span>de <\/span>e–<\/span>mail, <\/span>sisteme <\/span>de <\/span>ticketing, <\/span>platforme\n<\/span>de r\u0103spuns  <\/span>la  <\/span><\/span>incidente\n <\/span><\/span>sau\n <\/span><\/span>instrumente\n <\/span><\/span>de\n <\/span><\/span>colaborare\n <\/span><\/span>(de\n <\/span><\/span>exemplu, <\/span>T<\/span>e<\/span>ams,  <\/span><\/span>Slack)  <\/span><\/span>pentru comunicarea la timp\na riscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea p\u0103r\u021bilor ter\u021be<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Integrarea <\/span>furnizorilor <\/span>\u0219i <\/span>partenerilor <\/span>\u00een <\/span>procesul <\/span>de <\/span>comunicare <\/span>prin <\/span>clauze <\/span>contractuale, protocoale comune de ra<\/span>portare sau planuri comune de r\u0103spuns la\nincidente (IRP).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i instruirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Men\u021binerea <\/span>unui <\/span>protocol\n<\/span>de <\/span>comunicare <\/span>sau <\/span>a <\/span>unui <\/span>manual <\/span>\u0219i <\/span>instruirea <\/span>personalului <\/span>relevant cu privire la modul \u0219i momentul \u00een care trebuie\nraportate riscurile de securitate cibernetic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i \u00eembun\u0103t\u0103\u021birea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>estarea <\/span>\u0219i <\/span>revizuirea <\/span>periodic\u0103 <\/span>a <\/span>eficacit\u0103\u021bii <\/span>comunic\u0103rii <\/span>prin <\/span>exerci\u021bii\n<\/span>teoretice <\/span>sau <\/span>revizuiri post-incident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest <\/span>Control <\/span>sprijin\u0103 <\/span>implementarea <\/span>GV.RM-03.2, <\/span>asigur\u00e2nd <\/span>comunicarea <\/span>riscurilor <\/span>identificate <\/span>\u0219i documentate c\u0103tre p\u0103r\u021bile <\/span>interesate relevante, permi\u021b\u00e2nd un r\u0103spuns\n\u0219i o coordonare \u00een timp util.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[GV.RR] R<\/span>OLURI, RESPONSABILIT\u0102\u021aI \u0218I ATRIBU\u021aII DE\nAUTORITATE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rolurile,\nresponsabilit\u0103\u021bile \u0219i atribu\u021biil<\/span>e de\nautoritate \u00een materie de securitate cibernetic\u0103 pentru a promova r\u0103spunderea,\nevaluarea performan\u021bei \u0219i \u00eembun\u0103t\u0103\u021birea continu\u0103 sunt stabilite \u0219i comunicate. GV.RR-01<\/b><\/span><\/p>\n\n

Conducerea organiza\u021biei\neste responsabil\u0103 \u0219i r\u0103spunz\u0103toare pentr<\/span>u\nriscul de securitate cibernetic\u0103 \u0219i promoveaz\u0103 o cultur\u0103 con\u0219tient\u0103 de riscuri,\netic\u0103 \u0219i \u00een continu\u0103 \u00eembun\u0103t\u0103\u021bire.<\/span><\/p>\n\n

GV.RR-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Conducerea de v\u00e2rf a\norganiza\u021biei trebuie s\u0103 fi<\/span>e\nresponsabil\u0103 \u0219i r\u0103spunz\u0103toare pentru riscul de securitate cibernetic\u0103 \u0219i trebui<\/span>e s\u0103 promoveze o cultur\u0103 con\u0219tient\u0103 de ri<\/span>scuri, etic\u0103 \u0219i \u00een continu\u0103 \u00eembun\u0103t\u0103\u021bire.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>co<\/span>nducerea\n<\/span>de <\/span>v\u00e2rf <\/span>este <\/span>r\u0103s<\/span>punz\u0103toare <\/span>pentru <\/span>riscul <\/span>de securitate cibernetic\u0103 \u0219i promoveaz\u0103 o\ncultur\u0103 co<\/span>n\u0219tient\u0103 de riscuri \u0219i \u00een\ncontinu\u0103 \u00eembun\u0103t\u0103\u021bire.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Conducerea <\/span>de <\/span>v\u00e2rf <\/span>a <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>convin\u0103 <\/span>asupra <\/span>rolurilor <\/span>\u0219i <\/span>responsabilit\u0103\u021bilor <\/span>sale \u00een elaborarea, implementarea \u0219i\nevaluarea strategiei de securitate cibernetic\u0103 a or<\/span>ganiz<\/span>a\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>A\u0219tept\u0103rile conducerii de v\u00e2rf a or<\/span>ganiz<\/span>a\u021biei\n\u00een ceea ce prive\u0219te o cultur\u0103 a securit\u0103\u021bii, inclusiv eviden\u021bierea <\/span>exemplelor <\/span>pozitive <\/span>sau <\/span>negative\n<\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>de <\/span>securitat<\/span>e <\/span>cibernetic\u0103,\nar trebui comunicate \u00eentregii or<\/span>ganiza\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Conducerea <\/span>de <\/span>v\u00e2rf <\/span>a <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>dispun\u0103 <\/span>ca <\/span>managerul <\/span>superior\n<\/span>pentru securitatea informa\u021biei (de exemplu, manager de securitate <\/span>– CSO, manager securitatea informa\u021biei <\/span>– CISO) s\u0103 men\u021bin\u0103 o strategie\ncuprinz\u0103toare de management al riscului de securitate cibernetic\u0103 \u0219i s\u0103 o\nrevizuiasc\u0103 <\/span>\u0219i <\/span>s\u0103 <\/span>o <\/span>actualizeze <\/span>cel <\/span>pu\u021bin <\/span>anual <\/span>\u0219i <\/span>dup\u0103 <\/span>evenimente <\/span>majore <\/span>(a <\/span>se <\/span>vedea <\/span>\u0219i <\/span>GV<\/span>.RR<\/span>–<\/span><\/p>\n\n

02.2).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar \n<\/span>trebui  <\/span>efectuate  <\/span>revizuiri \n<\/span>pentru  <\/span>a  <\/span>se \n<\/span>asigura  <\/span>autoritate<\/span>a \n<\/span>\u0219i  <\/span>coordonarea  <\/span>adecvate \n<\/span>\u00eentre persoanele responsabile de gestionarea riscului de securitate cibernetic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RR-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rolurile,\nresponsabilit\u0103\u021bile \u0219i atribu\u021biile de autoritate legate de managementul riscului\nde securitate cibernetic\u0103 sunt stabilite, comunicate, \u00een\u021b<\/span>elese \u0219i puse \u00een aplicare.<\/span><\/p>\n\n

GV.RR-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rolurile,\nresponsabilit\u0103\u021bile \u0219i atribu\u021biile de autoritate \u00een materie de securitate\ncibernetic\u0103 sau a informa\u021biei pentru angaja\u021bi, furnizori, clien\u021bi \u0219i parteneri\ntrebuie docume<\/span>ntate, revizu<\/span>ite, autorizate, actualizate, comunicate\n\u0219i coordonate la nivel intern \u0219i extern.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>toate <\/span>p\u0103r\u021bile\n<\/span>interne <\/span>\u0219i <\/span>externe\n<\/span>\u00een\u021beleg <\/span>\u0219i <\/span>\u00ee\u0219i <\/span>\u00eendeplinesc\nrolurile, responsabilit\u0103\u021bile \u0219i atribu\u021biile de autoritate \u00een mater<\/span>ie de securitate cibernetic\u0103, reduc\u00e2nd\nlacunele, suprapunerile \u0219i \u00eent\u00e2rzierile \u00een r\u0103spu<\/span>nsul la incidente \u0219i \u00een conformitate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui luate\n\u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Descrierea <\/span>rolurilor<\/span>, <\/span>responsabilit\u0103\u021bilor <\/span>\u0219i <\/span>at<\/span>ribu\u021biilor\n<\/span>de <\/span>autoritate <\/span>\u00een <\/span>materie <\/span>de <\/span>securitate: <\/span>cine din\n<\/span>cadrul <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>trebui <\/span>consultat, <\/span>informat, <\/span>considerat <\/span>responsabil <\/span>\u0219i <\/span>tras <\/span>la <\/span>r\u0103spundere\npentru <\/span>toate <\/span>sau <\/span>o <\/span>parte\n<\/span>din <\/span>activele <\/span>or<\/span>ganiza\u021biei. <\/span>Poate\n<\/span>fi <\/span>luat\u0103 <\/span>\u00een <\/span>considerare <\/span>utilizarea <\/span>modelul<\/span>ui\nresponsabil, <\/span>r\u0103spunz\u0103tor<\/span>, <\/span>consultat, <\/span>infor<\/span>mat <\/span>(RACI).\n<\/span>Ghidul <\/span>poate <\/span>fi <\/span>g\u0103<\/span>sit <\/span>\u0219i <\/span>\u00een <\/span>Profilurile <\/span>de <\/span>rol\nale <\/span>Cadrului <\/span>european <\/span>al <\/span>competen\u021belor <\/span>\u00een <\/span>securit<\/span>ate <\/span>cibernetic\u0103 <\/span>(ECSF) <\/span>elaborate <\/span>de <\/span>c\u0103tre <\/span>ENISA<\/span> (https:\/\/www<\/span>.enisa.europa.eu\/publications\/european<\/span>-cybersecurity-skills-framework-role-<\/span><\/a> profiles).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Includerea rolurilor<\/span>, responsabilit\u0103\u021bilor \u0219i atribu\u021biilor de\nautoritate \u00een materie de <\/span>management\nal riscului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Includerea <\/span>responsabilit<\/span>\u0103\u021bilor <\/span>\u0219i <\/span>cerin\u021belor <\/span>de <\/span>performan\u021b\u0103 <\/span>\u00een <\/span>materie <\/span>de <\/span>securitatea <\/span>cibernetic\u0103 sau a informa\u021biei \u00een\ndescrierile posturilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Articularea <\/span>\u00een <\/span>mod <\/span>clar <\/span>a <\/span>responsabilit\u0103\u021bilor <\/span>\u00een <\/span>materie <\/span>de <\/span>securitatea <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei \u00een cadrul op<\/span>era\u021biunilor<\/span>, func\u021biilor de risc \u0219i func\u021biilor de audit intern.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Identificarea unuia sau mai multor\nrolur<\/span>i ori posturi specifice care vor\nfi responsabile \u0219i r\u0103spunz\u0103toare de planificarea, alocarea resurselor \u0219i ex<\/span>ecutarea activit\u0103\u021bil<\/span>o<\/span>r de management al\nriscului \u00een lan\u021bul de aprovizionare pentru securitate cibernetic\u0103 (C<\/span>-SCRM) sau a informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Urmarea <\/span>orient\u0103rii <\/span>anterioare, <\/span>extinderea <\/span>rolurilor<\/span>, <\/span>responsabilit\u0103\u021bilor <\/span>\u0219i <\/span>atribu\u021biilor <\/span>de <\/span>autoritate\nde securitate intern\u0103 la rolurile, re<\/span>sp<\/span>onsabilit\u0103\u021bile <\/span>\u0219i atribu\u021biile de autoritate C<\/span>–S<\/span>CRM sau\n<\/span>a informa\u021biei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dezvoltarea rolurilor<\/span>, responsabilit\u0103\u021bilor \u0219i atribu\u021biilor de <\/span>autoritate pentru furnizori, clien\u021bi \u0219i\nparteneri <\/span>ai <\/span>or<\/span>ganiza\u021biei <\/span>pentru\n<\/span>abordarea <\/span>responsabilit\u0103\u021bilor <\/span>comune\n<\/span>pentru <\/span>riscuri<\/span>le <\/span>aplicabile <\/span>de securitate cibernetic\u0103 sau a\ninforma\u021biei \u0219i integrarea acestora \u00een politic<\/span>ile\nor<\/span>ganiza\u021biei \u0219i \u00een acordurile\naplicabile p\u0103r\u021bilor ter\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Comunicare<\/span>a <\/span>intern\u0103\n<\/span>a <\/span>rolurilor <\/span>\u0219i <\/span>responsabilit\u0103\u021bilor <\/span>C<\/span>-SCRM <\/span>sau <\/span>a <\/span>inform<\/span>a\u021biei <\/span>pentru\n<\/span>p\u0103r\u021bi <\/span>ter\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Stabilirea de reguli \u0219i protocoale\npentru proces<\/span>ele de schimb de\ninforma\u021bii \u0219i de raportare \u00eentre or<\/span>ganiza\u021bie\n\u0219i furnizorii s\u0103i.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>stabilirii <\/span>unei <\/span>distinc\u021bii <\/span>clare\n<\/span>\u00eentre <\/span>IT <\/span>\u0219i <\/span>OT <\/span>\u00een <\/span>implementarea <\/span>acestui<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Control,\n\u021bin\u00e2nd cont de urm\u0103toarel<\/span>e:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Roluri\n\u0219i responsabilit\u0103\u021bi<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>IT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Definirea <\/span>de <\/span>roluri <\/span>prec<\/span>um <\/span>administrator <\/span>de <\/span>sistem, <\/span>analist\n<\/span>de <\/span>securitate <\/span>a <\/span>re\u021belelor<\/span>, personal de r\u0103spuns la incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Definirea  <\/span><\/span>de  <\/span><\/span>roluri  <\/span><\/span>precum\n <\/span><\/span>inginer\n <\/span><\/span>sisteme\n <\/span><\/span>de\n <\/span><\/span>control,\n <\/span><\/span>coordonator\n <\/span><\/span>securitate\ncibernetic\u0103 OT<\/span>, operator de\ninstala\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documentare\n\u0219i revizuire<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Asigurarea\ndocument\u0103rii separate, dar aliniate, a rolurilor IT <\/span>\u0219i OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Ciclurile <\/span>de <\/span>revizuire <\/span>pot <\/span>diferi: <\/span>IT (trimestrial\/anual), <\/span>O<\/span>T\n(aliniat <\/span>cu <\/span>perioadele <\/span>de mentenan\u021b\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Autorizare\n\u0219i actualiz\u0103ri<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Asigurarea <\/span>aprob\u0103rii\n<\/span>documenta\u021biei <\/span>IT <\/span>\u0219i <\/span>OT\nde <\/span>c\u0103tre <\/span>conducerea <\/span>relevant\u0103 <\/span>(de <\/span>exemplu,\nresponsabilul <\/span>pentru tehnologia <\/span>informa\u021biei <\/span>– <\/span>CIO <\/span>pentru IT<\/span>, <\/span>dir<\/span>ector <\/span>de <\/span>fabric\u0103 <\/span>pentru OT).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Actualiz\u0103rile\n <\/span><\/span>\u00een\n <\/span><\/span>OT  <\/span>pot  <\/span><\/span>necesita  <\/span><\/span>proceduri  <\/span><\/span>de  <\/span><\/span>control\n <\/span><\/span>al\n <\/span><\/span>modific\u0103rilor\n <\/span><\/span>din\n <\/span>c<\/span>a<\/span>uza implica\u021biilor asupra siguran\u021bei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunicare <\/span>\u0219i coordonare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Intern<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Asigurarea\nexisten\u021bei unor IRP-uri comune ale echipelor IT <\/span>\u0219i OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Extern<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Includerea <\/span>furnizorilor <\/span>\u0219i <\/span>partenerilor <\/span>specifici <\/span>O<\/span>T <\/span>(de <\/span>exemplu, <\/span>v\u00e2nz\u0103torii <\/span>ICS) <\/span>\u0219i <\/span>IT (de exemplu, furnizorii de servicii\ncloud).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RR-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 numeasc\u0103 un manager superior\npentru securitatea informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>stabili <\/span>o <\/span>r\u0103spundere <\/span>executiv\u0103\n<\/span>clar\u0103 <\/span>pentru <\/span>securitatea <\/span>cibernetic\u0103, prin numire<\/span>a\nunui membru al conducerii superioare care s\u0103 conduc\u0103 strategia, supravegherea\n\u0219i alinierea la obiectivele organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Un\n<\/span>membru <\/span>al <\/span>conducerii <\/span>superioare <\/span>este <\/span>defi<\/span>nit <\/span>ca <\/span>un <\/span>membru\n<\/span>de <\/span>rang <\/span>\u00eenalt\n<\/span>al <\/span>or<\/span>ganiza\u021biei, implicat \u00een procesele importante de luare a deciziilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Managerul <\/span>superior <\/span>pentru <\/span>securit<\/span>atea <\/span>inform<\/span>a\u021biei, <\/span>care <\/span>ar <\/span>putea <\/span>fi <\/span>CISO, <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 autoritatea, responsabilitatea \u0219i resu<\/span>rsele <\/span>necesare\npentru <\/span>a coordona, dezvolta,\nimplementa, monitoriza <\/span>\u0219i <\/span>men\u021bine\n<\/span>o viziune, <\/span>o <\/span>strategie\n<\/span>\u0219i <\/span>un <\/span>program <\/span>la <\/span>nivelul\n<\/span>\u00eentregii <\/span>or<\/span>ganiza\u021bii, <\/span>pentru <\/span>a se asigura c\u0103\nactivele \u0219i tehnologiile in<\/span>forma\u021bionale\nsunt protejate \u00een mod adecvat.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RR-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Resursele <\/span>adecvate <\/span>sunt <\/span>a<\/span>locate <\/span>propor\u021bional <\/span>cu <\/span>strategia, <\/span>rolurile,\n<\/span>responsabilit\u0103\u021bile <\/span>\u0219i <\/span>politicile\n<\/span>de management al riscului de securitate cibernetic\u0103.<\/span><\/p>\n\n

GV.RR-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>alocate <\/span>resurse <\/span>suficiente <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>strategia, <\/span>rolurile,\n<\/span>responsabilit\u0103\u021bile <\/span>\u0219i <\/span>politicile de management al riscului <\/span>de securitate cibernetic\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 securitatea cibernetic\u0103 este sus\u021binut\u0103 \u00een mod\neficace prin <\/span>alinierea <\/span>aloc\u0103rii\n<\/span>resurselor <\/span>(care <\/span>pot <\/span>include <\/span>personal, <\/span>buget, <\/span>tehnologie) <\/span>la <\/span>priorit\u0103\u021bile <\/span>strategice, rolurile \u0219i politicile.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar trebui efectuate rev<\/span>izuiri periodice ale managementului pentru\na asigura c\u0103 persoanele responsabile de ma<\/span>nagementul\nriscu<\/span>lui de securitate cibernetic\u0103\ndispun de autoritatea necesar\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Alocarea resurselor \u0219i investi\u021biile\nar trebui stabilite \u00een conformitate cu apetitul pentru risc al or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>asigurate <\/span>resurse\n<\/span>umane, <\/span>procese <\/span>\u0219i <\/span>resurse <\/span>tehnice\n<\/span>ade<\/span>cvate <\/span>\u0219i <\/span>suficiente <\/span>pentru <\/span>a\nsprijini strategia de securitate cibernetic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Personalul specializat ar trebui s\u0103\nde\u021bin\u0103 cuno\u0219tin\u021bele \u0219i competen\u021bele necesare pentru securitatea OT<\/span>, pentru a permite colaborarea cu\ninginerii OT<\/span>, astfel \u00eenc\u00e2t alertele\ns\u0103 fie in<\/span>terpretate cu acurate\u021be \u0219i\ns\u0103 se r\u0103spund\u0103 \u00een mod eficace la amenin\u021b\u0103ri.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RR-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>atribuie <\/span>rolur<\/span>i <\/span>\u0219i <\/span>responsab<\/span>ilit\u0103\u021bi\n<\/span>pentru <\/span>revizuirea <\/span>\u0219i <\/span>actualizarea <\/span>planurilor <\/span>de r\u0103spuns <\/span>\u0219i <\/span>recuperare, <\/span>asigur\u00e2ndu-se <\/span>c\u0103 <\/span>acestea reflect\u0103 <\/span>modific<\/span>\u0103rile <\/span>din <\/span>mediul <\/span>de <\/span>risc <\/span>\u0219i <\/span>r\u0103m\u00e2n\neficace.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura eficacitatea planurilor de r\u0103spuns \u0219i recuperare prin atribuirea de\nroluri \u0219i responsabilit\u0103\u021bi pentru revizuirea \u0219i adaptarea <\/span>periodic\u0103 la riscuril<\/span>e \u00een continu\u0103 evolu\u021bie.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea \u0219i atribuirea responsabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Atribuirea <\/span>de <\/span>roluri <\/span>clare <\/span>pentru <\/span>men\u021binerea, <\/span>revizuirea <\/span>\u0219i <\/span>actualizarea <\/span>planurilor <\/span>de <\/span>r\u0103spuns \u0219i recuperare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea <\/span>faptului <\/span>c\u0103 <\/span>persoanele <\/span>fizice <\/span>responsabile <\/span>au <\/span>autoritatea <\/span>\u0219i <\/span>resursele <\/span>necesare pentru a ac\u021biona \u00een func\u021bie de\nmodific\u0103rile identificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Desemnarea <\/span>unui <\/span>coordonator <\/span>central\n<\/span>sau <\/span>a <\/span>unei <\/span>echipe <\/span>pentru <\/span>supravegherea <\/span>procesului <\/span>de actualizare \u0219i asigurarea\n<\/span>r\u0103spunderii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cen\u021belegerea \u0219i monitorizarea contextului or<\/span>ganiza\u021bional<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluarea\nperiodic\u0103 a factorilor interni \u0219i externi, precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Structura\nor<\/span>ganiza\u021bional\u0103 \u0219i sistemele\ncritice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Amenin\u021b\u0103rile\n\u0219i vulnerabilit\u0103\u021bile emer<\/span>gente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Modific\u0103rile\nreglement\u0103rilor \u0219i dinamica pie\u021bei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Lec\u021biile\n\u00eenv\u0103\u021bate din incidente, teste sau exerci\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualizarea planurilor \u00ee<\/span>n func\u021bie de modific\u0103rile <\/span>contextuale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirea\np<\/span>lanurilor pe<\/span>ntru a reflecta:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Amenin\u021b\u0103rile\nnoi sau \u00een evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Modific\u0103rile\ntehnologiei sau infrastructurii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Provoc\u0103rile\nopera\u021bionale <\/span>sau lacunele identificat<\/span>e \u00een timpul test\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualiz\u0103rile <\/span>pot <\/span>include <\/span>liste\n<\/span>de <\/span>contacte, <\/span>protocoale <\/span>de <\/span>comunicare, <\/span>c\u0103i <\/span>de <\/span>escaladare <\/span>\u0219i aloc\u0103ri de resurse.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Comunicare<\/span>a\n\u0219i instruirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea\ninform\u0103rii p\u0103r\u021bilor interesate rele<\/span>vante\ncu privire la actualiz\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Furnizarea <\/span>de <\/span>instruire\n<\/span>sau <\/span>sesiuni <\/span>de <\/span>informare <\/span>pentru <\/span>a <\/span>clarifica\n<\/span>rolurile <\/span>\u0219i <\/span>responsabilit\u0103\u021bile din planurile <\/span>revizuite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estare \u0219i \u00eembun\u0103t\u0103\u021bire<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea <\/span>de <\/span>exerci\u021bii <\/span>\u0219i <\/span>sim<\/span>ul\u0103ri <\/span>periodice <\/span>pentru <\/span>validarea <\/span>eficacit\u0103\u021bii <\/span>planurilor <\/span>actualizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea\nrezultatelor pentru identificarea <\/span>lacunelor\n\u0219i stimularea \u00eembun\u0103t\u0103\u021birii contin<\/span>ue.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ciclul de revizuire continu\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea\nunui calendar de revizuire (de exemplu, trimestrial s<\/span>au dup\u0103 mo<\/span>dific\u0103ri\nmajore).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Integrarea <\/span>actualiz\u0103rilor <\/span>planului\n<\/span>\u00een <\/span>procesele <\/span>mai <\/span>ample <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>\u0219i <\/span>de\nguvernan\u021b\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RR-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Securitatea <\/span>cibernetic\u0103 este inclus\u0103 \u00een practicile de\nresurse umane.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV.RR-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Personalul <\/span>care <\/span>are <\/span>acces <\/span>la <\/span>inform<\/span>a\u021biile <\/span>sau <\/span>tehnologiile <\/span>cele <\/span>mai <\/span>critice <\/span>ale <\/span>organiza\u021biei <\/span>trebuie <\/span>s\u0103 fie\nautentificat.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul  <\/span><\/span>acestui  <\/span><\/span>Control\n <\/span><\/span>este\n <\/span><\/span>de\n <\/span><\/span>a\n <\/span><\/span>proteja\n <\/span><\/span>activele\n <\/span><\/span>critice\n <\/span><\/span>prin\n <\/span><\/span>asigurarea\n <\/span><\/span>faptului\n <\/span><\/span>c\u0103\n <\/span><\/span>numai\npersonalul autentificat poate avea acces la acestea.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u201eAutentificat” \u00eenseamn\u0103 c\u0103\nutilizatorul trebu<\/span>ie s\u0103<\/span>-\u0219i dovedeasc\u0103 identitatea din punct de\nvedere tehnic <\/span>la <\/span>punctul\n<\/span>de <\/span>acces, <\/span>\u00een <\/span>mod <\/span>ideal <\/span>utiliz\u00e2n<\/span>d <\/span>MF<\/span>A <\/span>sau <\/span>metode\n<\/span>mai <\/span>puternice, <\/span>nu <\/span>doar <\/span>validat \u00een timpul procesului de integrare\nor<\/span>ganiza\u021bional\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Accesul <\/span>la <\/span>informa\u021bii <\/span>sau <\/span>tehnologii <\/span>critice\n<\/span>ar <\/span>trebui <\/span>luat <\/span>\u00een <\/span>considerare <\/span>\u00een <\/span>cadrul <\/span>recrut\u0103rii, <\/span>\u00een cadrul <\/span>proce<\/span>sului <\/span>de <\/span>integrare\n<\/span>or<\/span>ganiza\u021bional\u0103, <\/span>pe <\/span>durata <\/span>rela\u021biilor\n<\/span>contractuale, la <\/span>modificarea\nfunc\u021biei \u0219i \u00een cadrul procesului de ie\u0219ire or<\/span>ganiza\u021bional\u0103\n(\u00eencetarea <\/span>rela\u021biilor contractuale).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>V<\/span>erific\u0103rile <\/span>de <\/span>fond <\/span>ar <\/span>tr<\/span>ebui <\/span>efectuate <\/span>\u00eenainte\n<\/span>de <\/span>integrarea <\/span>noului\n<\/span>personal <\/span>\u00een <\/span>rolur<\/span>i <\/span>sensibile, <\/span>iar verific\u0103rile de fond ar trebui repet<\/span>ate peri<\/span>odic pentru\npersonalul care ocup\u0103 astfel de roluri. V<\/span>erific\u0103rile\nde <\/span>fond <\/span>ar <\/span>trebui <\/span>totu\u0219i <\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>cont <\/span>de <\/span>legile, <\/span>reglement\u0103rile <\/span>\u0219i <\/span>principiile <\/span>etice aplicabile, <\/span>propor\u021bional <\/span>cu <\/span>cerin\u021bele\n<\/span>o<\/span>r<\/span>ganiza\u021biei, <\/span>clasificarea <\/span>informa\u021biilor <\/span>la <\/span>care <\/span>se <\/span>va <\/span>avea <\/span>acces\n\u0219i riscurile percepute.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Expertiza <\/span>\u00een <\/span>domeniul <\/span>securit\u0103\u021bii <\/span>cibernetice <\/span>ar <\/span>trebui <\/span>recuno<\/span>scut\u0103 <\/span>ca <\/span>un <\/span>atu <\/span>valoros\n<\/span>\u00een <\/span>deciziile de recrutare,\ninstruire \u0219i reten\u021bie a personalului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.RR-04.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie elaborat \u0219i\nmen\u021binut un proces de securitate <\/span>cibernetic\u0103\npentru resurse umane<\/span>, aplicabil la\nrecrutare, pe durata angaj\u0103rii \u0219i la \u00eencetarea contractului de munc\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura gestionarea riscurilor de securitate cibernetic\u0103 pe\ntot parcursul <\/span>ciclului <\/span>de <\/span>via\u021b\u0103 <\/span>al angaja\u021bilor, <\/span>prin <\/span>integrarea <\/span>securit\u0103\u021bii <\/span>\u00een <\/span>proc<\/span>esele <\/span>de <\/span>resu<\/span>rse <\/span>umane, <\/span>de\nla angajare p\u00e2n\u0103 la \u00eenceta<\/span>rea <\/span>contractului de munc\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Considerentele privind managem<\/span>entul riscului de securitate cibernetic\u0103 ar\ntrebui integrate \u00een procesele de resurse umane (de exemplu, ve<\/span>rificarea personalului, procesul de\nintegrare or<\/span>ganiza\u021bional\u0103,\nnotificarea modific\u0103rilor \u0219i procesul de ie\u0219ire or<\/span>ganiza\u021bional\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Procesul <\/span>de <\/span>securitat<\/span>e <\/span>cibernetic\u0103 <\/span>a <\/span>resurselor <\/span>umane <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\n<\/span>accesul <\/span>la <\/span>informa\u021bii <\/span>sau tehnologii critice, verific\u0103ri de fond, codul de conduit\u0103,\nroluri, atribu\u021bii de autoritate \u0219i responsabilit\u0103\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Obliga\u021biile <\/span>personalului <\/span>de <\/span>a <\/span>cunoa\u0219te, <\/span>adera <\/span>\u0219i <\/span>respecta <\/span>politi<\/span>cile <\/span>de <\/span>securitate\n<\/span>\u00een <\/span>raport <\/span>cu <\/span>rolul\nlor ar trebui definite \u0219i puse \u00een aplicare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[GV.PO] P<\/span>OLITICI<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Politica organiza\u021biei privind securitatea cibernetic\u0103\neste stabilit\u0103, comunicat\u0103 \u0219i pus\u0103 \u00een aplicare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV.PO-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Politica de gestionare a riscurilor\nde secur<\/span>itate cibernetic\u0103 este sta<\/span>bilit\u0103 pe baza contextului\norganiza\u021bional, a strategiei de securitate cibernetic\u0103 \u0219i a priorit\u0103\u021bilor \u0219i\neste comunicat\u0103 \u0219i pus\u0103 \u00een aplicare.<\/span><\/p>\n\n

GV.PO-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Politicile <\/span>\u0219i <\/span>procedurile\npentru <\/span>gestionarea <\/span>securit\u0103\u021bii <\/span>cibernetice <\/span>sau <\/span>a <\/span>inf<\/span>orma\u021biei <\/span>trebuie <\/span>stabilite, documentate, revizuite,\naprobate, actualizate atunci c\u00e2nd ap<\/span>ar\nmodific\u0103ri, comunicate \u0219i puse \u00een aplicare.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest <\/span>Control <\/span>stabile\u0219te <\/span>baza <\/span>modulu<\/span>i <\/span>\u00een <\/span>care <\/span>ar <\/span>tr<\/span>ebui <\/span>gestionate <\/span>toate <\/span>politicile <\/span>\u0219i <\/span>proc<\/span>edurile\n<\/span>p<\/span>rivind securitatea <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei. <\/span>Acesta <\/span>pune <\/span>accentul\n<\/span>pe <\/span>ciclul <\/span>de <\/span>via\u021b\u0103 <\/span>al <\/span>guvernan\u021bei, <\/span>de <\/span>la\ncreare p\u00e2n\u0103 la punerea \u00een aplicare \u0219i asigur\u0103 alinierea la direc\u021bia strategic\u0103\na organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui <\/span>luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Elaborarea de politici, procese \u0219i proceduri clare \u0219i\npractice care:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Definesc <\/span>comportamente <\/span>\u0219i <\/span>a\u0219tept\u0103ri <\/span>acceptabile <\/span>pentru <\/span>protejarea <\/span>informa\u021biilor <\/span>\u0219i <\/span>sistemelor or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Precizeaz\u0103 <\/span>modul\n<\/span>\u00een <\/span>care <\/span>conducerea <\/span>se <\/span>a\u0219teapt\u0103 <\/span>ca <\/span>angaja\u021bii <\/span>s\u0103 <\/span>utilizeze <\/span>\u0219i <\/span>s\u0103 <\/span>protejeze resursele or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea con\u0219tientiz\u0103rii angaja\u021bilor prin\ncomunicarea acestor politici, procese \u0219i proceduri:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>La\nintegrarea or<\/span>ganiza\u021bional\u0103 a noului\npersonal;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ori\nde c\u00e2te ori se fac <\/span>actualiz\u0103ri sau\nmodific\u0103ri semnificative;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Men\u021binerea  <\/span><\/span>accesibilit\u0103\u021bii,  <\/span><\/span>prin\n <\/span><\/span>punerea\n <\/span><\/span>cu\n <\/span><\/span>u\u0219urin\u021b\u0103\n <\/span><\/span>la\n <\/span><\/span>dispozi\u021bia\n <\/span><\/span>angaja\u021bilor\n <\/span><\/span>a\n <\/span><\/span>tuturor\ndocumentelor relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i actualizarea periodice (de exemplu,\nanual) pentru a reflecta:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modific\u0103rile\nor<\/span>ganiza\u021bionale, precu<\/span>m fuziuni, achizi\u021bii sau noi obliga\u021bii\ncontractuale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evolu\u021bii <\/span>tehnologice, <\/span>precum <\/span>adoptarea <\/span>inteligen\u021bei <\/span>artificiale <\/span>sau <\/span>a <\/span>unor <\/span>noi <\/span>instrumente <\/span>de securitate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Definirea <\/span>criteriilor <\/span>de <\/span>evaluare <\/span>a <\/span>riscurilor <\/span>\u00een <\/span>cadrul <\/span>politicii <\/span>de <\/span>manag<\/span>ement <\/span>al <\/span>riscului\n<\/span>a or<\/span>ganiza\u021biei:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>stabileasc\u0103 <\/span>\u0219i <\/span>s\u0103 <\/span>documenteze <\/span>criterii <\/span>clare <\/span>pentru <\/span>determinarea\nprobabilit\u0103\u021bii \u0219i impactului riscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>criterii <\/span>ar <\/span>trebui <\/span>adaptate\n<\/span>contextului <\/span>specific <\/span>al <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>utilizate <\/span>\u00een <\/span>mod\nconsecvent <\/span>pentru <\/span>evaluarea\n<\/span>\u0219i <\/span>prioritizarea <\/span>ri<\/span>scurilor <\/span>de <\/span>securitate <\/span>cibernetic\u0103. Astfel <\/span>se asigur\u0103 <\/span>c\u0103 <\/span>deciziile\n<\/span>bazate <\/span>pe <\/span>risc <\/span>sunt <\/span>aliniate\n<\/span>la <\/span>strategia <\/span>general\u0103\n<\/span>\u0219i <\/span>la <\/span>apetitul <\/span>pentru <\/span>risc <\/span>al\nor<\/span>ganiza\u021biei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.PO-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Politicile <\/span>\u0219i <\/span>procedurile <\/span>privind securitatea <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>la <\/span>nivelul <\/span>\u00eentregii\n<\/span>organiza\u021bii trebuie <\/span>s\u0103 <\/span>includ\u0103 <\/span>utilizarea <\/span>criptografiei <\/span>\u0219i, <\/span>dup\u0103 <\/span>caz, <\/span>a <\/span>cript\u0103rii,\n<\/span>s\u0103 <\/span>reflecte <\/span>modific\u0103rile <\/span>\u00een <\/span>ceea ce prive\u0219te <\/span>cerin\u021bele, <\/span>amenin\u021b\u0103rile, <\/span>tehnologia <\/span>\u0219i <\/span>rol<\/span>uri<\/span>le <\/span>organiza\u021biei <\/span>\u0219i <\/span>s<\/span>\u0103 fie <\/span>aprobate\nde <\/span>conducerea superioar\u0103, care\nsupravegheaz\u0103 punerea lor \u00een aplicare.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest <\/span>Control\n<\/span>se <\/span>bazeaz\u0103 <\/span>pe <\/span>GV.PO–<\/span>01.1 <\/span>\u0219i <\/span>se <\/span>concentreaz\u0103 <\/span>pe <\/span>con\u021binutul <\/span>\u0219i <\/span>supravegherea <\/span>politicilor de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei. <\/span>Aces<\/span>ta asigur\u0103 <\/span>abordarea\n<\/span>unor <\/span>subiecte <\/span>tehnice\n<\/span>specifice (precum <\/span>criptografia <\/span>\u0219i <\/span>criptarea), <\/span>adaptarea\n<\/span>politicilor <\/span>la <\/span>modific\u0103ri <\/span>\u0219i <\/span>implicarea <\/span>activ\u0103 <\/span>a <\/span>conducerii superioare \u00een procesul de\naprobare \u0219i supraveghere.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar tr<\/span>ebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea domeniului de aplicare \u0219i a obiectivelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea  <\/span><\/span>aplic\u0103rii\n <\/span><\/span>politicilor\n <\/span><\/span>la\n <\/span><\/span>nivelul\n <\/span><\/span>\u00eentregii\n <\/span><\/span>or<\/span>ganiza\u021bii  <\/span><\/span>\u0219i  <\/span><\/span>a  <\/span><\/span>alinierii\n <\/span><\/span>acestora\n <\/span><\/span>cu\npriorit\u0103\u021bile or<\/span>ganiza\u021biei \u0219i cu cele\nde risc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea criptografiei \u0219i <\/span>a cript\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Abordarea\ncript\u0103rii \u00een repaus\/\u00een tranzit<\/span>,\nmanagementul cheil<\/span>or \u0219i algoritmii\naproba\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Definirea  <\/span><\/span>cazurilor\n <\/span><\/span>c\u00e2nd\n <\/span><\/span>criptarea\n <\/span><\/span>este\n <\/span><\/span>necesar\u0103\n <\/span><\/span>(de\n <\/span><\/span>exemplu,\n <\/span><\/span>date\n <\/span><\/span>personale,\n <\/span><\/span>acces\n <\/span><\/span>la\ndistan\u021b\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea politicilor actualizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualizarea\npoliticilor <\/span>pentru a reflecta\nmodific\u0103rile \u00een:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Cerin\u021bele\nle<\/span>gale\/de reglementare;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Peisajul\namenin\u021b\u0103rilor;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>T<\/span>ehnologie;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Structura\nor<\/span>ganiza\u021bional\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Supravegherea realizat\u0103 de c\u0103tre <\/span>conducerea superioar\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Solicitarea\naprob\u0103rii formale a conducer<\/span>ii\nsuperioare a or<\/span>ganiza\u021biei<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Desemnarea  <\/span><\/span>unui  <\/span><\/span>resp<\/span>onsabil\n <\/span><\/span>de\n <\/span><\/span>politici\n <\/span><\/span>(de\n <\/span><\/span>exemplu,\n <\/span><\/span>CISO)\n <\/span><\/span>pentru\n <\/span><\/span>supravegherea\nimplement\u0103rii \u0219i conformit\u0103\u021bii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Atribuirea rolurilor \u0219i responsabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea      <\/span> <\/span><\/span>profilurilor      <\/span> <\/span><\/span>de     \n<\/span> <\/span><\/span>rol     \n<\/span> <\/span><\/span>ECSF      <\/span> <\/span><\/span>el<\/span>aborat      <\/span> <\/span><\/span>de     \n<\/span> <\/span><\/span>c\u0103tre      <\/span> <\/span><\/span>ENISA<\/span> (https:\/\/www<\/span>.enisa.europa.eu\/publications\/european<\/span>-cybersecurity-skills-framework-role-<\/span><\/a> profiles) pen<\/span>tru:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Definirea <\/span>rolurilor <\/span>\u00een <\/span>domeniul <\/span>securit\u0103\u021bii <\/span>cibernetice <\/span>(de <\/span>exemplu,\n<\/span>responsabil <\/span>de <\/span>politici, manager <\/span>de <\/span>risc);<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Alinierea <\/span>sarcinilor<\/span>, <\/span>abilit\u0103\u021b<\/span>ilor <\/span>\u0219i <\/span>competen\u021belor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Comunicare<\/span>a\n\u0219i instruirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Diseminarea\npoliticilor \u0219i furnizarea <\/span>de\ninstruire specific\u0103 rolului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i punerea \u00een aplicare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea\ncontroalelor tehnice \u0219i auditurilor pentru a asigura conformitatea.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[GV.OV] S<\/span>UPRAVEG<\/span>HERE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rezultatele activit\u0103\u021bilor \u0219i\nperforman\u021belor de management al riscului de securitate cibernetic\u0103 la nivelul\n\u00eentregii organiza\u021bii sunt utilizate pentru a inf<\/span>orma, \u00eembun\u0103t\u0103\u021bi \u0219i ajusta strategia de management al riscului.<\/span><\/p>\n\n

GV.OV<\/span>-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Strategia <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>este <\/span>revizuit\u0103 <\/span>\u0219i <\/span>ajustat\u0103 <\/span>pentru <\/span>a <\/span>asigura acoperirea cerin\u021belor \u0219i\nriscurilor organiza\u021biei.<\/span><\/p>\n\n

GV.OV<\/span>-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Strategia de man<\/span>agement al riscului de securitate\ncibernetic\u0103 sau a infor<\/span>ma\u021biei trebuie\nrevizuit\u0103 \u0219i ajustat\u0103 pentru asigurare<\/span>a\nacoperirii cerin\u021belor \u0219i riscurilor organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>strategia <\/span>de <\/span>management <\/span>al <\/span>riscului\nde <\/span>securitate cibernetic\u0103 sau a\ninforma\u021biei este revizuit\u0103 \u0219i actualizat\u0103 periodic pentru a reflecta nevoile\norganiza\u021biei, riscurile \u00een evolu\u021bie \u0219i cerin\u021bele de conformitate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een <\/span>considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Strategia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>defineasc\u0103 <\/span>direc\u021bia <\/span>general\u0103 <\/span>\u0219i <\/span>obiectivele <\/span>pentru <\/span>gestionarea <\/span>riscurilor <\/span>de securitate cibernetic\u0103 sa<\/span>u\na informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Politicile <\/span>\u0219i <\/span>procedurile <\/span>de <\/span>sprijin <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ghideze <\/span>modul\n<\/span>\u00een <\/span>care <\/span>strategia <\/span>este <\/span>p<\/span>us\u0103 <\/span>\u00een <\/span>practic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Strategia <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>abordeze <\/span>riscurile <\/span>pentru <\/span>opera\u021biunile <\/span>or<\/span>ganiza\u021biei, <\/span>activele, <\/span>persoanele <\/span>fizice \u0219i\nalte entit\u0103\u021bi, inclusiv poten\u021bialele impacturi as<\/span>upra vie\u021bii private.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Revizuirile <\/span>ar <\/span>trebui <\/span>efectuate <\/span>la <\/span>intervale <\/span>planificate, <\/span>incl<\/span>usiv <\/span>prin <\/span>audituri <\/span>interne,\n<\/span>pe <\/span>baza <\/span>unui program de audit documentat care define\u0219te frecven\u021ba,\nmetodele, responsabilit\u0103\u021bile \u0219i raportarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Auditurile ar trebui efectuate de personal competent\n\u0219i impar\u021bial.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Rezultatele <\/span>auditului <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>pentru <\/span>a <\/span>evalua <\/span>dac\u0103 <\/span>strategia\n<\/span>\u00eendepline\u0219te <\/span>a\u0219tept\u0103rile\ninterne \u0219i respect\u0103 cerin\u021bele legale \u0219i de reglementare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Strategia <\/span>ar <\/span>trebui\n<\/span>actualizat\u0103 <\/span>atunci <\/span>c\u00e2nd <\/span>este <\/span>necesar<\/span>, <\/span>\u00een <\/span>special <\/span>dup\u0103 <\/span>incidente <\/span>sau <\/span>constat\u0103ri <\/span>ale auditului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dovezile <\/span>activit\u0103\u021bilor <\/span>de <\/span>audit <\/span>\u0219i <\/span>rezu<\/span>ltatele\n<\/span>acestora <\/span>ar <\/span>trebui\n<\/span>documentate <\/span>\u0219i <\/span>raportate <\/span>conducerii relevante.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.OV<\/span>-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Performan\u021ba <\/span>organiza\u021biei <\/span>\u00een <\/span>materie\n<\/span>de <\/span>manageme<\/span>nt <\/span>al <\/span>ri<\/span>scului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>este <\/span>evaluat\u0103 \u0219i\nrevizuit\u0103 pentru identificarea ajust\u0103rilor necesare.<\/span><\/p>\n\n

GV.OV<\/span>-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Performan\u021ba <\/span>organiza\u021bie<\/span>i <\/span>\u00een <\/span>materie <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>trebuie evaluat\u0103, revizuit\u0103 \u0219i ajustat\u0103 atunci c\u00e2nd este\nnecesar.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>performan\u021ba <\/span>organiza\u021biei <\/span>\u00een <\/span>mate<\/span>rie <\/span>de <\/span>management <\/span>al riscului de securitate cibernetic\u0103 este evaluat\u0103, revizuit\u0103\n\u0219i ajustat\u0103 \u00een mod continuu, dup\u0103 cum este necesar.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Indicatorii <\/span>cheie <\/span>de <\/span>performan\u021b\u0103 <\/span>(KPI) <\/span>ar <\/span>trebui <\/span>identifica\u021bi, <\/span>implementa<\/span>\u021bi <\/span>\u0219i <\/span>revizui\u021bi <\/span>periodic pentru <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>politicile <\/span>\u0219i <\/span>procedurile <\/span>la nivelul\n<\/span>\u00eentregii <\/span>or<\/span>ganiza\u021bii\n<\/span>ating <\/span>obiectivele <\/span>\u00een materie de securitate cibernetic\u0103 sau <\/span>a informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Indicatorii <\/span>cheie <\/span>de <\/span>risc <\/span>de <\/span>securitate <\/span>ciber<\/span>netic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>ar <\/span>trebui <\/span>evalua\u021bi\n<\/span>periodic pentru identificarea riscurilor la care <\/span>este expus\u0103 or<\/span>ganiza\u021bia,\ninclusiv probabilitatea \u0219i impactul poten\u021bial. Indicatorii de risc de\nsecuritate cibernetic\u0103 sau a informa\u021biei sunt, de exemplu:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Num\u0103rul\nde atacuri <\/span>cibernetice detectate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Num\u0103rul\nde scur<\/span>geri de date detectate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>impul necesar\npentru detec\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>impul necesar\npentru recuperare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Num\u0103rul\nde dispozitive care nu sunt gestionate de or<\/span>ganiza\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Nivelul\nde acces al diferi\u021bilor utilizatori la datele s<\/span>ensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Num\u0103rul\nde software \u0219i sisteme neactualizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Num\u0103rul\nconexiunilor de re\u021bea negestionate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Indicatorii privind managementul\nriscului de securitate cibernetic\u0103 sau a informa\u021biei ar trebui colecta\u021bi \u0219i\ncomunica\u021bi conducer<\/span>ii superioare a or<\/span>ganiza\u021biei<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[GV.SC]\nC-SCRM<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Procesele <\/span>C-SCRM <\/span>sunt <\/span>identificate, <\/span>stabilite, <\/span>gestionate, <\/span>monitorizate <\/span>\u0219i <\/span>\u00eembun\u0103t\u0103\u021bite <\/span>de <\/span>c\u0103tre <\/span>p\u0103r\u021bile interesate ale organiza\u021bi<\/span>ei.<\/span><\/p>\n\n

GV.SC-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Un\n<\/span>program, <\/span>o <\/span>strategie, <\/span>obiective, <\/span>politici <\/span>\u0219i <\/span>procese <\/span>C<\/span>-SCRM <\/span>sunt <\/span>stabilite <\/span>\u0219i <\/span>convenite <\/span>de <\/span>p\u0103r\u021bile\ninteresate ale organiza\u021bi<\/span>ei.<\/span><\/p>\n\n

GV.SC-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Un\n<\/span>program, <\/span>o <\/span>strategie, <\/span>obiective, <\/span>politici <\/span>\u0219i <\/span>procese <\/span>C<\/span>–S<\/span>CRM <\/span>trebuie <\/span>documentate, <\/span>revizuite, actualizate atunci c\u00e2nd apar modific\u0103ri \u0219i aprobate\nde p\u0103r\u021bile interesate ale <\/span>organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>ge<\/span>stionarea <\/span>proactiv\u0103 <\/span>a <\/span>riscurilor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 ale lan\u021bului de aprovizionare\nprintr<\/span>-un program de <\/span>manageme<\/span>nt\nal riscului documentat, aprobat de p\u0103r\u021bile interesate <\/span>\u0219i actualizat periodic.<\/span><\/p>\n\n

Organiza\u021biil<\/span>e <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare <\/span>pa\u0219ii <\/span>de <\/span>mai <\/span>jos <\/span>pentru <\/span>stabilirea <\/span>unui <\/span>program <\/span>C<\/span>-SCRM<\/span><\/p>\n\n

 <\/span><\/p>\n\n

care s\u0103 fie aliniat la obiectivele lor strategice \u0219i\nsus\u021binut de toate p\u0103r\u021bile interesate relevante:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea programului \u0219i a str<\/span>ategiei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea\nobiectivelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Definirea <\/span>clar\u0103\n<\/span>a <\/span>ceea <\/span>ce <\/span>urm\u0103re\u0219te <\/span>s\u0103 <\/span>realizeze <\/span>or<\/span>ganiza\u021bia <\/span>prin <\/span>programul <\/span>s\u0103u <\/span>C<\/span>-SCRM.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivele  <\/span><\/span>pot  <\/span><\/span>include\n <\/span><\/span>protec\u021bia\n <\/span><\/span>\u00eempotriva\n <\/span><\/span>atacurilor\n <\/span><\/span>\u00een\n <\/span><\/span>lan\u021bul\n <\/span><\/span>de\n <\/span><\/span>aprovizionare,\nasigurarea conformit\u0103\u021bii cu reglement\u0103rile \u0219i men\u021b<\/span>inerea continuit\u0103\u021bii activit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dezvoltarea <\/span>unei <\/span>strategii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Conturarea  <\/span>unei \n<\/span>strategii  <\/span>la  <\/span>nivel  <\/span>\u00eenalt,  <\/span>aliniat\u0103 \n<\/span>cu  <\/span>strategiile  <\/span>generale \n<\/span>de  <\/span>securitate cibernetic\u0103 <\/span>\u0219i <\/span>ale <\/span>activit\u0103\u021bii <\/span>or<\/span>ganiza\u021biei. <\/span>Aceasta\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>planuri\n<\/span>de <\/span>evaluare <\/span>a riscurilor<\/span>, de atenuare a riscurilor \u0219i de monitorizare continu\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implicarea <\/span>p\u0103r\u021bilor <\/span>interesate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea <\/span>p\u0103r\u021bilor\n<\/span>interesate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Determinarea <\/span>p\u0103r\u021bilor\n<\/span>interesate <\/span>cheie, <\/span>inclusiv\n<\/span>echipele <\/span>de <\/span>conducere, <\/span>IT<\/span>, <\/span>achizi\u021bii, <\/span>juridic \u0219i conformitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implicarea <\/span>p\u0103r\u021bilor\n<\/span>int<\/span>eresate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Implicarea  <\/span>p\u0103r\u021bilor \n<\/span>interesate  <\/span>\u00eenc\u0103  <\/span>din \n<\/span>faza  <\/span>incipient\u0103  <\/span>a \n<\/span>procesului  <\/span>pentru  <\/span>a \n<\/span>asigura contribu\u021bia <\/span>\u0219i <\/span>acceptul\n<\/span>acestora. Ac<\/span>easta <\/span>se <\/span>poate <\/span>realiza\n<\/span>prin <\/span>intermediul <\/span>atelierelor<\/span>, \u00eent\u00e2lnirilor \u0219i actualiz\u0103rilor periodice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea politicilor \u0219i proce<\/span>selor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Elaborarea\npoliticilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Crearea <\/span>unor <\/span>politici <\/span>documentate <\/span>cuprinz\u0103toare <\/span>care <\/span>s\u0103 <\/span>acopere <\/span>toate <\/span>aspectele <\/span>C<\/span>-SCRM,\ninclusiv managementul riscului <\/span>v\u00e2nz\u0103torilor<\/span>, r\u0103spunsul la incidente \u0219i cerin\u021bele de\nconformitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implementarea\nproceselor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Definirea\n\u0219i documentarea proceselor de evaluare a riscurilor<\/span>, evaluare a <\/span>v\u00e2nz\u0103torilor<\/span>, gestionare <\/span>a <\/span>contractelor <\/span>\u0219i <\/span>r\u0103spuns <\/span>la <\/span>incidente. <\/span>Asigurarea <\/span>integr\u0103rii <\/span>acestor <\/span>procese <\/span>\u00ee<\/span>n fluxurile de lucru existente ale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea \u0219i managementul riscului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea\nevalu\u0103rilor riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Evaluarea <\/span>periodic\u0103 <\/span>a <\/span>riscurilor <\/span>asociate\n<\/span>lan\u021bului <\/span>de <\/span>aprovizionare, <\/span>inclusiv <\/span>a <\/span>poten\u021bialelor vulnerabilit\u0103\u021bi \u0219i\namenin\u021b\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Atenuarea <\/span>riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Elaborarea\n\u0219i implementarea unor strategii de atenuare a riscurilor pe baza <\/span>rezultatelor evalu\u0103rii. A<\/span>cestea <\/span>pot <\/span>include\n<\/span>diversificarea <\/span>fur<\/span>nizorilor<\/span>, <\/span>\u00eembun\u0103t\u0103\u021birea <\/span>controalelor <\/span>de\nsecuritate \u0219i stabilirea planurilor de ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea <\/span>\u0219i <\/span>\u00eembun\u0103t\u0103\u021birea <\/span>continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea\ncontinu\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Implementarea  <\/span>monitoriz\u0103rii \n<\/span>continue  <\/span>a  <\/span>lan\u021bului \n<\/span>de  <\/span>aprovizionare  <\/span>pentru \n<\/span>detec\u021bia  <\/span>\u0219i r\u0103spunsul <\/span>prompt <\/span>la <\/span>noile <\/span>riscuri.\nAceasta <\/span>include <\/span>monitorizarea <\/span>performan\u021bei <\/span>\u0219i\nconformit\u0103\u021bii furnizorilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirea\n\u0219i \u00eembun\u0103t\u0103\u021birea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Revizuirea\nperiodic\u0103 a eficacit\u0103\u021bii programului C<\/span>–<\/span>SCRM \u0219i \u00eembun\u0103t\u0103\u021birea dup\u0103 cum este\nnecesar<\/span>. <\/span>Aceasta <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>observa\u021biile <\/span>p\u0103r\u021bilor <\/span>interesate <\/span>\u0219i <\/span>lec\u021bi<\/span>ile <\/span>\u00eenv\u0103\u021bate <\/span>din incidente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea <\/span>\u0219i <\/span>con\u0219tientizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Educarea\nangaja\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Furnizarea <\/span>unor <\/span>programe <\/span>de <\/span>instruire <\/span>\u0219i <\/span>con\u0219tientizare <\/span>pentru <\/span>angaja\u021bi, <\/span>pe<\/span>ntru <\/span>ca <\/span>ace\u0219tia\ns\u0103 <\/span>\u00een\u021beleag\u0103 <\/span>rolul <\/span>lor <\/span>\u00een <\/span>C-SCRM. <\/span>Aceasta\n<\/span>include <\/span>recunoa\u0219terea <\/span>riscuril<\/span>or <\/span>din <\/span>lan\u021bul <\/span>de aprovizionare \u0219i respectarea\npoliticilor \u0219i procedurilor stabilite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i comunicarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documentarea\ntuturor elementelor relevante<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Asigurarea <\/span>c\u0103 <\/span>toate <\/span>politicile, <\/span>procese<\/span>le, <\/span>evalu\u0103rile <\/span>riscurilor <\/span>\u0219i <\/span>planurile\n<\/span>de <\/span>atenuare <\/span>sunt bine documentate, actualizate,\naprobate de c\u0103tre persoana din conducerea or<\/span>ganiza\u021biei\ncu atribu\u021bii \u00een acest sens \u0219i accesibile p\u0103r\u021bilor interesate relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunicare<\/span>a eficace<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Men\u021binerea <\/span>unor <\/span>linii <\/span>de <\/span>comunicare <\/span>deschise\n<\/span>cu <\/span>p\u0103r\u021bile <\/span>interesate <\/span>pentru <\/span>a <\/span>le <\/span>\u021bine <\/span>la <\/span>curent\ncu progresul programului, modific\u0103rile \u0219i orice incidente care apar<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rolurile <\/span>\u0219i <\/span>responsabilit<\/span>\u0103\u021bile <\/span>\u00een <\/span>materie <\/span>de <\/span>securitate\n<\/span>cibernetic\u0103 <\/span>pentru <\/span>fur<\/span>nizori, <\/span>clien\u021bi <\/span>\u0219i <\/span>parteneri sunt stabilite, comunicate \u0219i\ncoordona<\/span>te la nivel intern \u0219i\nextern.<\/span><\/p>\n\n

GV.SC-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Furnizorii <\/span>ter\u021bi <\/span>trebuie <\/span>s\u0103 <\/span>notifice <\/span>orice\n<\/span>transfer, <\/span>\u00eencetare <\/span>sau <\/span>tr<\/span>anzi\u021bie\n<\/span>a <\/span>personalului <\/span>cu <\/span>acces <\/span>fizic\n<\/span>sau logic la ele<\/span>mentele\nsistemului critic pentru activitate ale organiza\u021biei.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>continuitatea <\/span>\u0219i <\/span>securitatea <\/span>sistemelor\n<\/span>critice, <\/span>impun\u00e2nd furnizorilor\nter\u021bi s\u0103 raporteze modific\u0103rile <\/span>de\npersonal care afecteaz\u0103 accesul.<\/span><\/p>\n\n

\u00cen\nvederea real<\/span>iz\u0103rii acestui obiectiv,\nar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Furnizorii <\/span>ter\u021bi <\/span>includ, <\/span>de <\/span>exemplu, <\/span>furnizori <\/span>de <\/span>servicii, <\/span>contractori <\/span>\u0219i <\/span>alte <\/span>or<\/span>ganiza\u021bii <\/span>care furnizeaz\u0103 servicii de dezvoltare de\nsisteme, servicii tehnologice, aplica\u021bii externalizat<\/span>e sau managementul re\u021belelor \u0219i securit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Regulile  <\/span>\u0219i \n<\/span>protocoalele  <\/span>pentru  <\/span>schimbul \n<\/span>de  <\/span>informa\u021bii  <\/span>\u00eentre \n<\/span>or<\/span>ganiza\u021bie  <\/span>\u0219i \n<\/span>furnizorii  <\/span>s\u0103i  <\/span>\u0219i furnizorii de nivel inferior ar trebui\ndefinite \u00een acordurile contractuale.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

C-SCRM <\/span>este <\/span>integrat\n<\/span>\u00een <\/span>procesele <\/span>de <\/span>management <\/span>al <\/span>risc<\/span>ului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>\u0219i <\/span>proc<\/span>esele<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ERM, precum \u0219i \u00een cele de evaluare <\/span>a riscurilor \u0219i de \u00eembun\u0103t\u0103\u021bire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

C-SCRM sa<\/span>u a informa\u021biei trebuie integrat \u00een procesele de management al\nriscului de <\/span>securitate cibernetic\u0103\nsau a informa\u021biei, \u00een procesele ERM, \u00een evaluarea riscurilor, precum \u0219i \u00een\nprocesele de \u00eembun\u0103t\u0103\u021bire.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 riscurile de securitate cibernetic\u0103 din lan\u021bul de aprovizionare <\/span>sunt identificate, <\/span>evaluate <\/span>\u0219i <\/span>atenuate\n<\/span>\u00een <\/span>mod <\/span>consecvent, <\/span>prin <\/span>integrarea <\/span>acestora <\/span>\u00een evalu\u0103rile\nriscurilor organiza\u021biei, revizuirile controalelor \u0219i ciclurile de \u00eembun\u0103t\u0103\u021bire\ncontinu\u0103.<\/span><\/p>\n\n

Pentru <\/span>integrarea <\/span>\u00een <\/span>mod <\/span>eficace\n<\/span>a <\/span>managementului <\/span>riscului\n<\/span>\u00een <\/span>lan\u021bu<\/span>l <\/span>de <\/span>aprovizionare <\/span>\u00een <\/span>cadrele <\/span>ma<\/span>i\nlargi de securitate cibernetic\u0103 \u0219i de risc la nivel de organiza\u021bie,\norganiza\u021biile ar trebui s\u0103 ia \u00ee<\/span>n\nconsiderare <\/span>urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea alinierii \u0219i suprapunerii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea <\/span>proceselor <\/span>existente <\/span>de <\/span>management <\/span>al <\/span>risc<\/span>ului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a informa\u021biei <\/span>\u0219i <\/span>ERM.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea <\/span>punctelor <\/span>de <\/span>contact <\/span>\u00een <\/span>care <\/span>riscur<\/span>il<\/span>e <\/span>lan\u021bului <\/span>de <\/span>aprovizionare <\/span>se <\/span>intersecteaz\u0103\ncu:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Managemen<\/span>tul v\u00e2nz\u0103torilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Achizi\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Continuitatea\nactivit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Aspecte\njuridice \u0219i de conformitat<\/span>e.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documentarea\nzonelor de suprapunere, duplicare <\/span>sau\nlacune pentru a eficientiza integrarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unor seturi de controale integrate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dezvoltarea\nunui cadru de cont<\/span>rol unificat care s\u0103\ninclud\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Controale <\/span>specifice\n<\/span>securit\u0103\u021bii <\/span>cibernetice <\/span>a <\/span>lan\u021bului <\/span>d<\/span>e <\/span>aprov<\/span>izionare <\/span>(de <\/span>exemplu, <\/span>accesul p\u0103r\u021bilor ter\u021be, gestionarea datelor<\/span>, <\/span>integritatea\nsoftware<\/span>-ului).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Controale\n <\/span><\/span>din\n <\/span><\/span>standardele\n <\/span><\/span>existente\n <\/span><\/span>de\n <\/span><\/span>securitate\n <\/span><\/span>cibernetic\u0103\n <\/span><\/span>(de\n <\/span><\/span>exemplu,\n <\/span><\/span>ISO\/IEC<\/span><\/p>\n\n

 <\/span><\/p>\n\n

27036).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea <\/span>c\u0103 <\/span>controalele <\/span>sunt <\/span>bazate <\/span>pe <\/span>risc, <\/span>scalabile\n<\/span>\u0219i <\/span>al<\/span>iniate <\/span>at\u00e2t <\/span>la <\/span>mediile <\/span>IT<\/span>, <\/span>c\u00e2t <\/span>\u0219i <\/span>la cele OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea \u00een procesele de evaluare a riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Includerea <\/span>scenariilor <\/span>de <\/span>amenin\u021b\u0103ri <\/span>specifice <\/span>lan\u021bului <\/span>de <\/span>aprovizionare <\/span>\u00een <\/span>evalu\u0103rile <\/span>riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(de\nexemplu, compromiterea furnizorilor<\/span>,\nhardw<\/span>are contraf\u0103cut, <\/span>vulnerabilit\u0103\u021bi software).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluarea <\/span>criticit\u0103\u021bii <\/span>furnizorilor <\/span>\u0219i <\/span>a <\/span>expunerii\n<\/span>la <\/span>risc <\/span>ca <\/span>parte <\/span>a <\/span>registrului <\/span>de <\/span>riscuri <\/span>ale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea  <\/span><\/span>unei  <\/span><\/span>evalu\u0103ri  <\/span><\/span>a  <\/span><\/span>riscuril<\/span>or  <\/span><\/span>pe  <\/span><\/span>niveluri,  <\/span><\/span>bazat\u0103  <\/span><\/span>pe  <\/span><\/span>impactul\n <\/span><\/span>furnizorului\n <\/span><\/span>\u0219i\nsensibilitate<\/span>a serviciilor\/datelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea \u00een procesul de \u00eembun\u0103t\u0103\u021bire continu\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cencorporarea <\/span>informa\u021biilor privind riscurile lan\u021bului\nde aprovizionare \u00een:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Lec\u021biile\n\u00eenv\u0103\u021bate din incidente \u0219i audituri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Revizuirile\npost-mortem ale \u00eentreruperilor legate de furnizori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Ciclurile\nde \u00eembun\u0103t\u0103\u021bire a proceselor (de exemplu, planific\u0103-execut\u0103-verific\u0103-ac\u021bioneaz\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

–\nPDCA).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualizarea <\/span>politicilor<\/span>, <\/span>procedurilor <\/span>\u0219i <\/span>controalelor <\/span>pe <\/span>baza <\/span>amenin\u021b\u0103rilor <\/span>\u00een <\/span>evolu\u021bie <\/span>\u0219i <\/span>a\nperforman\u021bei furnizorilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Escaladarea riscurilor semni<\/span>ficative la nivelul c<\/span>o<\/span>nducerii superioare a or<\/span>ganiza\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Definirea  <\/span><\/span>criteriilor  <\/span><\/span>de  <\/span><\/span>semnifica\u021bie\n <\/span><\/span>(de\n <\/span><\/span>exemplu,\n <\/span><\/span>impactul\n <\/span><\/span>financiar<\/span>,  <\/span><\/span>expunerea  <\/span><\/span>la reglement\u0103ri,\n\u00eentreruperi opera\u021bionale<\/span>).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea\nunei c\u0103i formale de escaladare c\u0103tre conducerea superioar\u0103 \u0219i comitetele de\nrisc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea\nc\u0103 riscurile semnificative din lan\u021bul de aprovizionare sunt:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Reflectate\n\u00een registrul de riscuri ale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Abordate\n\u00een discu\u021biile strategice privind riscurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Luate\n\u00een considerare \u00een planificarea continuit\u0103\u021bii activit\u0103\u021bii <\/span>\u0219i a managementul<\/span>ui crizelor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Cerin\u021bele privind abordarea\nriscurilor de securitate cibernetic\u0103 \u00een lan\u021burile de aprovizionare sunt\nstabilite, <\/span>prioritizate <\/span>\u0219i <\/span>integrate <\/span>\u00een <\/span>contracte <\/span>\u0219i <\/span>alte <\/span>tipuri <\/span>de\nacorduri <\/span>cu <\/span>furnizorii <\/span>\u0219i <\/span>alte <\/span>p\u0103r\u021bi <\/span>ter\u021be relevante.<\/span><\/p>\n\n

GV.SC-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Cerin\u021bele <\/span>privind <\/span>abordarea <\/span>riscurilor de <\/span>securitate <\/span>cibernetic\u0103 <\/span>\u0219i <\/span>schimbul <\/span>de <\/span>informa\u021bii <\/span>sensibile \u00een lan\u021burile <\/span>de <\/span>aprovizionare <\/span>trebuie\n<\/span>sta<\/span>bilite, <\/span>prioritizate, <\/span>integrate <\/span>\u00een <\/span>contracte\n<\/span>\u0219i <\/span>alte <\/span>tipuri <\/span>de <\/span>acorduri formale \u0219i puse \u00een aplicare.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Con<\/span>trol este de a stabili \u0219i a pune \u00een\naplicare cerin\u021bele privind securitatea cibernetic\u0103 \u0219i gestionarea datelor\nsensibile \u00een acordurile privind la<\/span>n\u021bul\nde aprovizionare prin integrarea acestora \u00een contracte \u0219i prioritizarea lor <\/span>\u00een func\u021bie de risc.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Acordurile <\/span>contractuale <\/span>\u0219i <\/span>alte <\/span>tipuri <\/span>de <\/span>acorduri <\/span>formale\n<\/span>cu <\/span>furnizorii <\/span>\u0219i <\/span>alte <\/span>p\u0103r\u021bi <\/span>ter\u021be <\/span>relevante ar trebui s\u0103 <\/span>defineasc\u0103 a\u0219tept\u0103rile, responsabili<\/span>t\u0103\u021bile \u0219i cerin\u021bele de securit<\/span>ate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Elementele <\/span>cheie <\/span>ale <\/span>acestor\n<\/span>acorduri <\/span>includ <\/span>schimbul\n<\/span>de <\/span>informa\u021bii <\/span>\u00eentre <\/span>or<\/span>ganiza\u021bie\n<\/span>\u0219i <\/span>furnizorii s\u0103i \u0219i\nfurnizorii de nivel inferior<\/span>,\ncontroale de securitate, r\u0103spunsul la incidente \u0219i respectarea standardelor \u0219i\nregle<\/span>ment\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Cerin\u021bele <\/span>de <\/span>securitate <\/span>pentru\n<\/span>furnizori, <\/span>produse <\/span>\u0219i <\/span>servicii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>propor\u021bionale <\/span>cu criticitatea \u0219i consecin\u021bele poten\u021biale <\/span>\u00een cazul compromiterii acestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>oate\n<\/span>cerin\u021bele <\/span>privind <\/span>securitatea <\/span>cibernetic\u0103 <\/span>\u0219i <\/span>lan\u021bul\n<\/span>de <\/span>aprovizionare <\/span>pe <\/span>care <\/span>p\u0103r\u021bile\n<\/span>ter\u021be trebuie <\/span>s\u0103 <\/span>le respecte <\/span>ar trebui <\/span>incluse <\/span>\u00een <\/span>limbajul <\/span>contractual <\/span>standard <\/span>(adic\u0103 <\/span>termeni\n<\/span>\u0219i <\/span>clauze pre-redactate, <\/span>utilizate \u00een <\/span>mod <\/span>obi\u0219nuit, <\/span>care <\/span>asigur\u0103 <\/span>coeren\u021ba,\n<\/span>conformitatea <\/span>\u0219i <\/span>claritatea). Contractul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>specifice, <\/span>de as<\/span>emenea, <\/span>modul <\/span>\u00een <\/span>care <\/span>va <\/span>fi <\/span>verificat\u0103 <\/span>conformitatea <\/span>cu aceste cerin\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>includerii <\/span>\u00een <\/span>punerea <\/span>\u00een <\/span>aplicare <\/span>a <\/span>faptului <\/span>c\u0103 <\/span>furn<\/span>izorii\n<\/span>\u0219i <\/span>utilizatorii <\/span>ter\u021bi (de exemplu, furnizori, clien\u021bi,\nparteneri) ar trebui s\u0103 poat\u0103 demonstra \u00een\u021bele<\/span>gerea\nrolurilor \u0219i responsabilit\u0103\u021bilor lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>definirii <\/span>cerin\u021belor <\/span>de <\/span>securitate <\/span>\u00een <\/span>acordurile <\/span>pentru <\/span>nivelul <\/span>serviciilor (SLA) <\/span>pentru <\/span>monitorizarea <\/span>furnizorilor <\/span>\u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te <\/span>performan\u021ba <\/span>ac<\/span>ceptabil\u0103 <\/span>\u00een <\/span>materie <\/span>de securitate pe tot parcursul ciclului de\nvia\u021b\u0103 al rela\u021biei cu furnizorul.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>posibilit\u0103\u021bii <\/span>de <\/span>a <\/span>impune <\/span>contractual <\/span>furnizorilor <\/span>s\u0103 <\/span>\u00ee\u0219i <\/span>verifice\n<\/span>angaja\u021bii \u0219i s\u0103 se protejeze \u00eempotriva amenin\u021b\u0103rilor din interior<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea \u00een considerare a posibilit\u0103\u021bii\nd<\/span>e a impune contractual furnizorilor\ns\u0103 furnizeze dovezi ale aplic\u0103rii unor practici de securitate acceptabile, de\nexemplu, prin autoevaluare (de exemplu, CyFun\u00ae), conformitate cu standardele\ncunoscute, verific\u0103ri (de exemplu, CyFun\u00ae), certific\u0103ri (de exemplu, CyFun\u00ae)\nsau inspec\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Re\u021binerea fa<\/span>ptului c\u0103 cerin\u021bele <\/span>Regulamentului\n(UE) 2016\/679 al Parlamentului Eu<\/span>ropean\n\u0219i al Consiliului <\/span>din <\/span>27 <\/span>aprilie <\/span>2016 <\/span>privind <\/span>protec\u021bia <\/span>persoanelor <\/span>fizice <\/span>\u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te <\/span>prelucrarea datelor <\/span>cu <\/span>caracter <\/span>personal\n<\/span>\u0219i <\/span>privind <\/span>libera <\/span>circula\u021bie <\/span>a <\/span>acestor <\/span>date <\/span>\u0219i <\/span>de <\/span>abrogare <\/span>a <\/span>Directivei<\/span><\/p>\n\n

95\/46\/CE, denumit \u00een\ncontinuare Regulamentul GDPR sau <\/span>GDPR<\/span>, trebuie respectate dac\u0103 informa\u021biile\naferente activit\u0103\u021bii con\u021bin date cu caracter personal (aplicabile la toate niv<\/span>elurile), adic\u0103 \u00een cadrul contractual\ntrebuie incluse m\u0103suri <\/span>de protec\u021bie<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-05.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Cerin\u021bele <\/span>contractuale <\/span>privind <\/span>securitatea\ncibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>pentru <\/span>furnizori <\/span>\u0219i <\/span>parteneri\nexterni <\/span>trebuie <\/span>implementate <\/span>pentru <\/span>a <\/span>asigura\n<\/span>un <\/span>proces <\/span>verificabil <\/span>de <\/span>rezolvare <\/span>a <\/span>defectelor <\/span>\u0219i <\/span>pentru\na garanta c\u0103 deficien\u021bele identifica<\/span>te\n\u00een timpul test\u0103rii \u0219i evalu\u0103rii securit\u0103\u021bii cibernetice sau a informa\u021biei <\/span>sunt <\/span>remediate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control, <\/span>care <\/span>e<\/span>ste <\/span>corelat\n<\/span>cu <\/span>GV.SC-09.1, <\/span>este <\/span>de <\/span>a <\/span>integra <\/span>c<\/span>erin\u021be <\/span>care <\/span>pot <\/span>fi <\/span>puse\n\u00een <\/span>aplicare <\/span>\u00een <\/span>contractele <\/span>cu <\/span>furnizorii <\/span>pentru\n<\/span>a <\/span>garanta <\/span>rezolvarea <\/span>\u00een <\/span>timp <\/span>util <\/span>a <\/span>defectelor <\/span>\u0219i <\/span>rezolvarea\nproblemelor de securitate cibernetic\u0103 identificate prin testare \u0219i evaluare.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii ac<\/span>estui obiectiv, <\/span>ar\ntrebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Sistemele <\/span>informatice <\/span>care <\/span>con\u021bin\n<\/span>software <\/span>(sau <\/span>firmware)\n<\/span>afectate <\/span>de <\/span>defectele <\/span>software <\/span>anun\u021bate\nrecent (\u0219i poten\u021bialele vulnerabilit\u0103\u021bi rezultate din aceste defec<\/span>te) ar trebui identificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Patch-urile, <\/span>pachetele <\/span>de <\/span>servicii\n<\/span>\u0219i <\/span>remedierile <\/span>rapide <\/span>relevante <\/span>pentru <\/span>securitate <\/span>recent <\/span>lansate\nar <\/span>trebui <\/span>instalate, <\/span>iar <\/span>aceste <\/span>patch<\/span>-uri, <\/span>pachete <\/span>de <\/span>servicii <\/span>\u0219i <\/span>re<\/span>medieri rapide <\/span>sunt <\/span>testate <\/span>\u00een <\/span>ceea\nce prive\u0219te eficacitatea \u0219i po<\/span>ten\u021bialele\nefecte secundar<\/span>e asupra sist<\/span>emelor informatice ale or<\/span>ganiza\u021biei \u00eenainte de instalare.\nDeficien\u021bele descoperite \u00een timpul evalu\u0103rilor de securitate, monitoriz\u0103rii <\/span>continue,\n<\/span>activit\u0103\u021bilor de <\/span>r\u0103spuns <\/span>la <\/span>incidente\nsau <\/span>gestion\u0103rii <\/span>erorilor\n<\/span>sistemulu<\/span>i informatic sunt, de\naseme<\/span>nea, remediate cu promptitudine.\nRemedierea defectelor ar trebui \u00eencorporat\u0103 \u00een managementul configura\u021biei ca\nmodificare de ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>posibilit\u0103\u021bii <\/span>de <\/span>a <\/span>impune <\/span>contr<\/span>actual <\/span>furnizorilor <\/span>s\u0103 <\/span>divulge <\/span>caracteristici de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei, <\/span>func\u021bii <\/span>\u0219i <\/span>vulnerabilit\u0103\u021bi <\/span>ale <\/span>produselor <\/span>\u0219i <\/span>serviciilor <\/span>lor pe durata de via\u021b\u0103 a produsului sau\npe durata serviciului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>posibilit\u0103\u021bii <\/span>de <\/span>a <\/span>impune <\/span>contractual <\/span>furnizorilor <\/span>s\u0103 <\/span>furnizeze <\/span>\u0219i <\/span>s\u0103 <\/span>men\u021bin\u0103 un <\/span>inventar <\/span>actualizat <\/span>al <\/span>componentelor <\/span>(de <\/span>exemplu, <\/span>Lista\n<\/span>componentelor <\/span>software <\/span>– <\/span>S<\/span>BOM <\/span>sau\nLista componentelor hardware <\/span>– HBOM)\npentru produsele critice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-05.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>stabileasc\u0103 <\/span>cerin\u021be <\/span>contractuale <\/span>care <\/span>s\u0103 <\/span>\u00eei <\/span>permit\u0103 <\/span>s\u0103 <\/span>revizuiasc\u0103 <\/span>programe<\/span>le <\/span>de securitate cibernetic\u0103 sa<\/span>u a informa\u021biei implementate de furnizori\n\u0219i parteneri ter\u021bi.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de a <\/span>asigura <\/span>c\u0103 <\/span>organiza\u021bia\npoate <\/span>evalua <\/span>\u0219i <\/span>verifica <\/span>practicile <\/span>de securitate <\/span>c<\/span>ibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>al<\/span>e <\/span>furnizorilor <\/span>\u0219i <\/span>partenerilor <\/span>ter\u021bi <\/span>prin <\/span>acorduri\n<\/span>contractuale. \u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een\nconsiderare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Cerin\u021be privind securitatea cibernetic\u0103 sau a\ninforma\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Contractele <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>defineasc\u0103 <\/span>a\u0219tept\u0103ri <\/span>cla<\/span>re <\/span>\u00een <\/span>materie\n<\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a informa\u021biei,\ninclusiv controale specifice OT<\/span>,\nacolo unde este cazul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Drepturi de audit \u0219i revizuire<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acordurile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>acorde <\/span>or<\/span>ganiza\u021biei <\/span>dreptul <\/span>de <\/span>a <\/span>audita, <\/span>evalua <\/span>sau <\/span>revizui\n<\/span>programele de securitate cibernetic\u0103 sau a informa\u021biei ale furnizorilor\n\u0219i partenerilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Metode de verificare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conformitatea <\/span>ar <\/span>trebui\n<\/span>verificat\u0103 <\/span>pri<\/span>n <\/span>autoevalu\u0103<\/span>ri, <\/span>certific\u0103ri <\/span>ale <\/span>unor <\/span>p\u0103r\u021bi\n<\/span>ter\u021be <\/span>sau <\/span>evalu\u0103ri de securitate programate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protocoale de schimb de informa\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Contractele  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>specifice  <\/span><\/span>ce  <\/span><\/span>informa\u021bii\n <\/span><\/span>legate\n <\/span><\/span>de\n <\/span><\/span>securitate\n <\/span><\/span>cibernetic\u0103\n <\/span><\/span>sau\n <\/span><\/span>a\ninforma\u021biei trebuie partajate, c\u00e2t de des \u0219i prin ce canale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizare continu\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Furnizorii ar trebui s\u0103 raporteze periodic postura de\nsecuritate cibernetic\u0103 sau a <\/span>informa\u021biei\n\u0219i s\u0103 dezv\u0103luie incidentele care ar putea afecta opera<\/span>\u021biunile, \u00een special \u00een mediile OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Consecin\u021bele neconformit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Contractele <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>precizeze <\/span>consecin\u021bele <\/span>nerespect\u0103rii <\/span>cerin\u021belor <\/span>privind\n<\/span>securitatea cibernetic\u0103 sau a informa\u021biei, pr<\/span>ecum sanc\u021biuni sau rezilierea contractului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Planificarea <\/span>\u0219i <\/span>due <\/span>diligence\n<\/span>sunt <\/span>efe<\/span>ctuate <\/span>pentru <\/span>a <\/span>reduce <\/span>riscurile\n<\/span>\u00eenai<\/span>nte <\/span>de <\/span>stabilirea <\/span>unor <\/span>rela\u021bii\nformale cu furnizorii sau cu alte p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

GV.SC-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Planificarea <\/span>\u0219i <\/span>due <\/span>diligence\n<\/span>trebuie <\/span>efectuate <\/span>pentru <\/span>a <\/span>reduce <\/span>riscurile <\/span>\u00eenainte\n<\/span>de <\/span>stabilirea <\/span>unor <\/span>rela\u021bii\nformale cu furnizorii sau cu alte p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nreduce ri<\/span>scurile de securitate\ncibernetic\u0103 \u0219i opera\u021bionale prin asigurarea <\/span>faptului <\/span>c\u0103 <\/span>planificarea <\/span>\u0219i <\/span>due <\/span>diligence\n<\/span>sunt <\/span>efectuate \u00een <\/span>mod <\/span>corespunz\u0103tor <\/span>\u00eenainte\n<\/span>de stabilirea unor rela\u021bii formale cu furnizorii <\/span>sau cu p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Due diligence bazat pe risc<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Due <\/span>diligence <\/span>ar <\/span>trebui <\/span>efectuat\n<\/span>asupra <\/span>furnizorilor <\/span>poten\u021biali <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>politica <\/span>de achizi\u021bii a or<\/span>ganiza\u021biei \u0219i ajus<\/span>tat\nla nivelul de risc, criticita<\/span>te \u0219i\ncomplexitate al rela\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea capabilit\u0103\u021bilor \u00een materie de securitate <\/span>cibernetic\u0103 \u0219i de management al riscului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Maturitatea <\/span>\u00een <\/span>materie\n<\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>practicile <\/span>de <\/span>management <\/span>al <\/span>riscului <\/span>\u0219i capabilit\u0103\u021bile <\/span>specifice <\/span>OT <\/span>ale <\/span>furnizorilor <\/span>ar <\/span>trebui <\/span>evaluate\n<\/span>din <\/span>punct <\/span>de <\/span>vedere <\/span>al <\/span>adecv\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea riscurilor furnizorilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>ri<\/span>scurilor\n<\/span>ar <\/span>trebui <\/span>efectuate\n<\/span>pentru <\/span>asigurarea <\/span>alinierii\n<\/span>la <\/span>nevoile <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>la\ncerin\u021bele <\/span>aplicabile <\/span>\u00een <\/span>materie <\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>inclusiv <\/span>cele <\/span>relevante\n<\/span>pentru <\/span>mediile O<\/span>T<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integritatea \u0219i securitatea produselor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Autenticitatea,  <\/span><\/span>integritatea  <\/span><\/span>\u0219i  <\/span><\/span>securitatea\n <\/span><\/span>produselor\n <\/span><\/span>\u0219i\n <\/span><\/span>componentelor\n <\/span><\/span>critice\n <\/span><\/span>ar\n <\/span><\/span>trebui\nverificate <\/span>\u00eenainte <\/span>de <\/span>achizi\u021bie <\/span>\u0219i <\/span>punere <\/span>\u00een <\/span>func\u021biune, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>sistemele <\/span>OT \u00een <\/span>care\nvulnerabilit\u0103\u021bile pot afecta siguran\u021ba \u0219i opera\u021biunile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-07<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Riscurile <\/span>prezentate <\/span>de <\/span>un <\/span>furnizor, <\/span>produsele\n<\/span>\u0219i <\/span>ser<\/span>viciile <\/span>acestuia <\/span>\u0219i <\/span>alte <\/span>p\u0103r\u021bi <\/span>ter\u021be <\/span>sunt <\/span>\u00een\u021belese,\n\u00eenregistrate, prioritizate, evaluate, gestionate \u0219i monitorizate pe parcursul\nrela\u021biei.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-07.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Riscurile prezentate de\nun furnizor, produsele \u0219i serviciile sale \u0219<\/span>i\nalte p\u0103r\u021bi ter\u021be trebuie identificate, documentate, <\/span>prioritizate, <\/span>atenuate <\/span>\u0219i <\/span>evaluate <\/span>cel <\/span>pu\u021bin <\/span>anual\n<\/span>\u0219i <\/span>atunci <\/span>c\u00e2nd <\/span>apar <\/span>modific\u0103ri <\/span>\u00een <\/span>cursul rela\u021biei.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a asigura\n<\/span>c\u0103 <\/span>riscurile legate <\/span>de <\/span>furnizori, <\/span>produsele \u0219i <\/span>serviciile acestora \u0219i alte p\u0103r\u021bi ter\u021be sunt identificate,\nevaluate, prioritizate \u0219i gestionate \u00een mod continuu pe tot parcursul rela\u021biei,\n\u00een special atunci c\u00e2nd apar modific\u0103ri \u00een sistemele critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar <\/span>trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evalu\u0103ri ale riscurilor personalizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Formatele <\/span>\u0219i <\/span>frecven\u021bele <\/span>evalu\u0103rilor <\/span>ar <\/span>trebui\n<\/span>adaptate <\/span>\u00een <\/span>func\u021bi<\/span>e <\/span>de <\/span>reputa\u021bia <\/span>furnizorului <\/span>\u0219i <\/span>de criticitatea\nproduselor sau serviciilor furnizate, inclusiv a <\/span>componentelor OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii mai ample privind riscurile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>riscurilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>poten\u021biale <\/span>\u00eentreruperi <\/span>ale <\/span>serviciilor <\/span>\u0219i <\/span>riscuri <\/span>de concentrare care ar putea afecta opera<\/span>\u021biunile sau mediile OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dovezi de conformitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Furnizorii <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>furnizeze <\/span>dovezi\n<\/span>ale <\/span>conformit\u0103\u021bii <\/span>cu <\/span>cerin\u021bele <\/span>contractuale <\/span>privind securitatea cibernetic\u0103, precum autoevalu\u0103ri (de\nexemplu, CyFun\u00ae), certific\u0103ri, garan\u021bii, rezultate ale testelor<\/span>, etichete sau rapoarte de audit\nrealizate de p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizare continu\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Furnizorii <\/span>critici <\/span>ar <\/span>trebui <\/span>monitoriza\u021bi <\/span>pe <\/span>tot <\/span>parcursul\n<\/span>rela\u021biei <\/span>prin <\/span>inspe<\/span>c\u021bii, <\/span>audituri,\n<\/span>teste sau <\/span>alte <\/span>metode <\/span>de <\/span>evaluare\n<\/span>pentru <\/span>a <\/span>se <\/span>asigura <\/span>c\u0103 <\/span>obliga\u021biile\nde <\/span>securitate <\/span>sunt \u00eendeplinite <\/span>\u00een\ncontinuare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualiz\u0103ri ale profilului de ris<\/span>c<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modific\u0103rile <\/span>serviciilor<\/span>, <\/span>produselor\n<\/span>sau <\/span>performan\u021belor <\/span>furnizorilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>determine <\/span>o reevaluare <\/span>a <\/span>profilului <\/span>de <\/span>risc <\/span>\u0219i <\/span>a <\/span>criticit\u0103\u021bii, <\/span>\u00een <\/span>special <\/span>atunci <\/span>c\u00e2nd <\/span>sunt <\/span>implicate <\/span>sisteme\n<\/span>OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Planificarea <\/span>continuit\u0103\u021bii <\/span>activit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui\n<\/span>s\u0103 <\/span>existe <\/span>un <\/span>plan <\/span>de <\/span>ac\u021biune <\/span>pentru\n<\/span>a <\/span>face <\/span>fa\u021b\u0103 <\/span>\u00eentreruperilor <\/span>nea\u0219teptate <\/span>ale furnizorilor \u0219i pentru a men\u021bine continuitatea\nopera\u021bional\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-07.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie sta<\/span>bilit\u0103, actualizat\u0103 \u0219i pus\u0103 la dispozi\u021bie\nonline \u0219i offline o list\u0103 documentat\u0103 a tuturor furnizorilor, <\/span>v\u00e2nz\u0103torilor <\/span>\u0219i <\/span>partenerilor <\/span>critici\n<\/span>ai <\/span>organiza\u021biei <\/span>care <\/span>ar <\/span>putea\n<\/span>fi <\/span>implica\u021bi <\/span>\u00eentr<\/span>-un <\/span>incident major, \u021bin\u00e2nd seama \u00een mod\ncorespunz\u0103tor de c<\/span>onfiden\u021bialitate\n\u0219i securitate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura men\u021bine<\/span>rea\n\u0219i accesibilitatea unei liste fiabile \u0219i actualizate <\/span>a <\/span>furnizorilor, <\/span>v\u00e2nz\u0103torilor <\/span>\u0219i <\/span>partenerilor <\/span>critici,\n<\/span>at\u00e2t <\/span>online, <\/span>c\u00e2t <\/span>\u0219i <\/span>offline,\n<\/span>pentru <\/span>a <\/span>sprijini r\u0103spunsul <\/span>rapid <\/span>\u00een <\/span>cazul\n<\/span>incidentelor <\/span>majore, <\/span>prot<\/span>ej\u00e2nd <\/span>\u00een <\/span>acela\u0219i <\/span>timp <\/span>confiden\u021bialitatea <\/span>\u0219i <\/span>secu<\/span>ritatea. \u00cen vederea realiz\u0103rii acestui\nobiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unei \u00eenregistr\u0103ri complete<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>men\u021binut\u0103\n<\/span>o <\/span>list\u0103 <\/span>complet\u0103 <\/span>a <\/span>furnizorilor<\/span>, <\/span>v\u00e2nz\u0103torilor <\/span>\u0219i <\/span>partenerilor<\/span>, <\/span>ca <\/span>baz\u0103 <\/span>pentru\nidentificarea celor criti<\/span>ci pentru\nopera\u021biuni, inclusiv mediile O<\/span>T<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea criteriilor de criticitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>stabilite\n<\/span>criterii <\/span>clare <\/span>pentru <\/span>clasificarea <\/span>criticit\u0103\u021bii <\/span>furnizorilor <\/span>pe <\/span>baza <\/span>unor <\/span>factori precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sensibilitatea\ndatelor pre<\/span>lucrate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Accesul\nla sisteme sau re\u021bele.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Importan\u021ba <\/span>pentru activitatea principal\u0103 sau\nfunc\u021biile OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea informa\u021biilor cheie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru\nfiecare furnizor critic, lista ar trebui s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Detalii\nde contact primare \u0219i secunda<\/span>re.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Descrierea\nserviciilor fur<\/span>nizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>C\u0103i\nde escaladare \u0219i disponibilitatea asisten\u021bei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea disponibilit\u0103\u021bii online \u0219i of<\/span>fline<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Lista\nar trebui s\u0103 fie:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Actualizat\u0103\nperiodic \u0219i stocat\u0103 \u00een mod securizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Accesibil\u0103 <\/span>at\u00e2t <\/span>online, <\/span>c\u00e2t <\/span>\u0219i <\/span>of<\/span>fline <\/span>(de <\/span>exemplu, <\/span>copii <\/span>tip\u0103rite, <\/span>dispozitive <\/span>USB <\/span>criptate)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

pentru asigurarea disponibilit\u0103\u021bii \u00een timpul\nincidentelor cibernetice sau al \u00eentreruperilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-07.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia  <\/span><\/span>trebuie  <\/span><\/span>s\u0103  <\/span><\/span>auditeze\n <\/span><\/span>furnizorii\n <\/span><\/span>ter\u021bi\n <\/span><\/span>de\n <\/span><\/span>servicii\n <\/span><\/span>critice\n <\/span><\/span>pe<\/span>ntru  <\/span><\/span>activitate,  <\/span><\/span>\u00een  <\/span><\/span>vederea conformit\u0103\u021bii cu\ncerin\u021bele de securita<\/span>te.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 furnizorii te<\/span>r\u021bi de\nservicii critice pentru activitate su<\/span>nt\naudita\u021bi periodic pentru a confirma confor<\/span>mitatea\ncu cerin\u021bele de securitate convenite, contribuind la gestionarea riscurilor pri<\/span>vind opera\u021biun<\/span>ile \u0219i sistemele critice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea <\/span>fur<\/span>nizorilor\n<\/span>critici<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Criticitatea <\/span>furnizorilor <\/span>ter\u021bi <\/span>de <\/span>servicii\n<\/span>ar <\/span>trebui <\/span>evaluat\u0103\n<\/span>pe <\/span>baza <\/span>impactului <\/span>acestora <\/span>asupra opera\u021biunilo<\/span>r<\/span>, inclusiv asupra\nsistemelor OT<\/span>, \u0219i a nivelului de risc\npe care \u00eel introduc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dovezi de audit acceptabile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Rezultatele <\/span>auditurilor <\/span>efectuate\n<\/span>de <\/span>p\u0103r\u021bi <\/span>ter\u021be, <\/span>precum <\/span>certific\u0103rile, <\/span>evalu\u0103rile <\/span>independente\nsau <\/span>atest\u0103rile <\/span>de <\/span>securitate, <\/span>ar <\/span>trebui <\/span>acceptate\n<\/span>ca <\/span>dovezi <\/span>valabile\n<\/span>ale <\/span>conformit\u0103\u021bii, <\/span>acolo <\/span>unde\neste cazul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Efectuarea auditurilor de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>efectuate\n<\/span>audituri <\/span>periodice <\/span>asupra <\/span>furnizorilor <\/span>critici\n<\/span>pentru <\/span>a <\/span>verifica\n<\/span>dac\u0103 <\/span>ace\u0219tia \u00eendeplinesc\nobliga\u021biile contractuale \u0219i de securitate bazate pe p<\/span>olitici.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-07.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>asigure <\/span>conformitatea <\/span>cu <\/span>obliga\u021biile <\/span>contractuale <\/span>privind <\/span>securitatea <\/span>cibernetic\u0103 sau <\/span>a <\/span>informa\u021biei <\/span>ale furnizorilor <\/span>\u0219i <\/span>partenerilor <\/span>ter\u021bi <\/span>prin\nrevizuiri periodice ale <\/span>auditurilor\nindependente, evalu\u0103rilo<\/span>r \u0219i a <\/span>celor efectuate de p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 furnizorii \u0219i partenerii ter\u021bi respect\u0103\nobliga\u021biile contractuale privind securitatea cibernetic\u0103 sau a informa\u021biei,\nprin revizuirea periodic\u0103 a <\/span>auditurilor\nindependente, a evalu\u0103rilor \u0219i a altor evalu\u0103ri efectuate de p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Fundamentarea pe controale conexe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acest <\/span>Control <\/span>ar <\/span>trebui <\/span>implementat <\/span>\u00een <\/span>conformit<\/span>ate <\/span>cu <\/span>GV<\/span>.S<\/span>C-05.3\n<\/span>\u0219i <\/span>GV<\/span>.SC-07.1 <\/span>pentru <\/span>a consolida supravegherea furnizorilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea evalu\u0103rilor riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Auditurile <\/span>independente <\/span>\u0219i <\/span>evalu\u0103rile <\/span>efectuate\n<\/span>de <\/span>p\u0103r\u021bi <\/span>ter\u021be <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>evalu\u0103ri <\/span>ale cerin\u021belor corporative \u0219i ale\ncerin\u021belor aplicabil<\/span>e \u00een materie de\nsecuritate cibernetic\u0103, inclusiv riscurile specifice lan\u021bului de aprovi<\/span>zionare \u0219i O<\/span>T<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificare \u00eenainte de ini\u021bierea colabor\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cenainte <\/span>de <\/span>angajarea\n<\/span>furnizorilor <\/span>critici, <\/span>evalu\u0103rile <\/span>independente <\/span>ar <\/span>trebui\n<\/span>revizuite <\/span>pentru confirmarea\nconformit\u0103\u021bii cu standardele \u0219i obliga\u021biile convenite \u00een materie de securitate\ncibernetic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Profunzimea revizuirii bazate pe risc<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Profunzimea <\/span>\u0219i <\/span>frecven\u021ba <\/span>revizuirilor <\/span>ar <\/span>trebui\n<\/span>adaptate <\/span>\u00een <\/span>func\u021bie\n<\/span>de <\/span>criticitatea <\/span>produselor sau serviciilor furnizorului.\nFurnizorii cu nivel mai ridicat de <\/span>criticitate\nar trebui s\u0103 fie <\/span>supu\u0219i unor evalu\u0103ri\nmai aprofundate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-08<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Furnizorii <\/span>relevan\u021bi <\/span>\u0219i <\/span>alte <\/span>p\u0103r\u021bi <\/span>ter\u021be\n<\/span>sunt <\/span>inclu\u0219i <\/span>\u00een <\/span>activit\u0103\u021bile <\/span>de <\/span>planificare, <\/span>r\u0103spuns\n<\/span>\u0219i <\/span>recuperare <\/span>\u00een caz de incidente.<\/span><\/p>\n\n

GV.SC-08.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>identifice <\/span>\u0219i <\/span>s\u0103 <\/span>documenteze <\/span>personalul <\/span>cheie <\/span>al <\/span>furn<\/span>izorilor\n<\/span>relevan\u021bi <\/span>\u0219i <\/span>al <\/span>altor\np\u0103r\u021bi ter\u021be pentru a<\/span>–<\/span>i integra \u00een activit\u0103\u021bile de planificare,\nr\u0103spuns \u0219i recup<\/span>erare \u00een caz de\nincidente. GHID DE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>consolida\n<\/span>preg\u0103tirea <\/span>pentru incidente <\/span>\u0219i <\/span>recuperarea <\/span>ulterioar\u0103<\/span>,\nprin <\/span>asigurarea identific<\/span>\u0103rii <\/span>\u0219i <\/span>integr\u0103rii <\/span>active <\/span>a <\/span>personalului <\/span>cheie <\/span>al <\/span>furnizorilor <\/span>critici <\/span>\u0219i <\/span>al <\/span>altor\np\u0103r\u021bi ter\u021be \u00een planificarea \u0219i desf\u0103\u0219urarea activit\u0103\u021bilor de r\u0103spuns <\/span>la incidente.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea protocoalelor de comunicare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar trebui de<\/span>finite\nreguli <\/span>\u0219i proceduri <\/span>clare <\/span>pentru <\/span>raportarea <\/span>st\u0103rii <\/span>incidentelor \u0219i <\/span>coordonarea activit\u0103\u021bilor de r\u0103s<\/span>puns \u0219i recuperare \u00eentre or<\/span>ganiza\u021bie \u0219i furnizorii s\u0103i critici pentru\nactivitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea rolurilor \u0219i responsabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Rolurile, <\/span>responsabilit\u0103\u021bile <\/span>\u0219i <\/span>autoritatea <\/span>pentru <\/span>r\u0103spunsul <\/span>la <\/span>incidente <\/span>ar <\/span>trebui <\/span>documentate at\u00e2t pentru echipele interne,\nc\u00e2t \u0219<\/span>i pentru participan\u021bii ter\u021bi,\ninclusiv cei care sus\u021bin sistemele \u0219i infrastructura OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Promovarea \u00eenv\u0103\u021b\u0103rii comune<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dup\u0103 <\/span>incidente <\/span>majore,\n<\/span>ar <\/span>trebui <\/span>or<\/span>ganizate, <\/span>\u00eempreun\u0103\n<\/span>cu <\/span>furnizorii <\/span>critici\n<\/span>\u0219i <\/span>p\u0103r\u021bile <\/span>ter\u021be, sesiuni de a<\/span>naliz\u0103 a lec\u021biilor \u00eenv\u0103\u021bate, pentru <\/span>a \u00eembun\u0103t\u0103\u021bi coordonarea \u0219i rezilien\u021ba \u00een viitor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-09<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Practicile <\/span>de <\/span>securitate <\/span>a <\/span>lan\u021bului\nde <\/span>aprovizionare <\/span>sunt <\/span>integrate <\/span>\u00een <\/span>progr<\/span>amele <\/span>de <\/span>securitate cibernetic\u0103 \u0219i ERM, iar\nperforman\u021ba acestora este monitorizat\u0103 pe tot parcursul ciclului de <\/span>via\u021b\u0103 al produselor \u0219i serviciilor\ntehnologice.<\/span><\/p>\n\n

GV.SC-09.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Practicile <\/span>de <\/span>securitate <\/span>a <\/span>lan\u021bului\nde <\/span>aprovizi<\/span>onare <\/span>trebuie <\/span>integrate\n<\/span>\u00een <\/span>programele <\/span>de <\/span>securitate\ncibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>\u0219i <\/span>ER<\/span>M, <\/span>iar <\/span>performan\u021ba <\/span>acestora <\/span>trebuie\nmonitorizat\u0103 <\/span>pe <\/span>tot <\/span>parcurs<\/span>ul ciclului de via\u021b\u0103 al produselor \u0219i\nserviciilor.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>practicile <\/span>de <\/span>securitate <\/span>a <\/span>lan\u021bului <\/span>de <\/span>aprovizionare <\/span>sunt integrate <\/span>\u00een <\/span>programele <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>inform<\/span>a\u021biei <\/span>\u0219i <\/span>ERM, <\/span>pe<\/span>rforman\u021ba <\/span>acestora\n<\/span>fiind monitorizat\u0103 \u0219i \u00eembun\u0103t\u0103\u021bit\u0103 pe tot parcursul ciclului de via\u021b\u0103 al\nproduselor \u0219i serviciilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea <\/span>la <\/span>controalele <\/span>conexe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acest  <\/span><\/span>Control  <\/span><\/span>se  <\/span><\/span>bazeaz\u0103  <\/span><\/span>pe  <\/span><\/span>GV<\/span>.SC-05.2,  <\/span><\/span>asigur\u00e2nd  <\/span><\/span>c\u0103  <\/span><\/span>cerin\u021bele\n <\/span><\/span>contractuale\n <\/span><\/span>privind\nsecuritatea cibernetic\u0103 sau <\/span>a <\/span>informa\u021biei, <\/span>precum <\/span>rezolvarea <\/span>defectelor\n<\/span>\u0219i <\/span>remedierea deficien\u021belor\nidentificate, sunt gestionate \u00een mod activ \u00een cadrul programelor de risc mai\nample.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea bazelor de guv<\/span>ernan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politicile  <\/span><\/span>de  <\/span><\/span>securitate  <\/span><\/span>ale  <\/span><\/span>lan\u021bului\n <\/span><\/span>de\n <\/span><\/span>aprov<\/span>izionare  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>documentate,  <\/span><\/span>acoperind\na\u0219tept\u0103rile \u00een materie de securitate cibern<\/span>etic\u0103\nsa<\/span>u a informa\u021biei pentru furnizori\n\u0219i p\u0103r\u021bi ter\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea \u00een cadrele de risc<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Riscurile lan\u021bului de aprovizionare ar trebui <\/span>integrate \u00een cadrele de management al\nriscului la nivel de or<\/span>ganiza\u021bie \u0219i\nde securitate a informa\u021biei, inclusiv ri<\/span>scurile\n\u0219i dependen\u021bele specifice O<\/span>T<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Formalizarea a\u0219tept\u0103rilor \u00een materie de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Contractele <\/span>\u0219i <\/span>SLA-urile\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>clauze\n<\/span>clare <\/span>priv<\/span>ind <\/span>securitatea <\/span>cibernetic\u0103 <\/span>sau <\/span>a informa\u021biei,\ndrepturile de audit \u0219i indicatorii de performan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i evaluarea performan\u021bei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile  <\/span><\/span>riscurilor<\/span>,  <\/span><\/span>rapoartele  <\/span><\/span>de  <\/span><\/span>audit  <\/span><\/span>\u0219i  <\/span><\/span>\u00eenregistr\u0103rile\n <\/span><\/span>incidentelor  <\/span>ar  <\/span><\/span>trebui  <\/span><\/span>revizuite periodic <\/span>pentru <\/span>evaluarea <\/span>posturii furnizorului <\/span>\u0219i <\/span>identificarea <\/span>domeniilor <\/span>care <\/span>necesit\u0103\n\u00eembun\u0103t\u0103\u021biri.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Facilitarea <\/span>monitori<\/span>z\u0103rii <\/span>continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>de <\/span>monitorizare <\/span>\u0219i <\/span>KP<\/span>I<\/span>-urile <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>pentru <\/span>urm<\/span>\u0103rirea <\/span>performan\u021bei\nfurnizorilor \u00een <\/span>materie <\/span>de <\/span>securitate <\/span>pe <\/span>parcursul <\/span>\u00eentregului <\/span>ciclu <\/span>de <\/span>via\u021b\u0103, <\/span>inclusiv <\/span>ti<\/span>mpul <\/span>de r\u0103spuns la incidente \u0219i ratele de\nconformitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea con\u0219tientiz\u0103rii \u0219i instruirii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Programele  <\/span><\/span>de  <\/span><\/span>instruire  <\/span><\/span>\u0219i  <\/span><\/span>con\u0219tientizare  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>abordeze\n <\/span><\/span>riscurile\n <\/span><\/span>de\n <\/span><\/span>securitate\ncibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>legate\n<\/span>de <\/span>lan\u021bul <\/span>de <\/span>aprovizionare <\/span>at\u00e2t <\/span>pentru <\/span>echipele\n<\/span>interne, <\/span>c\u00e2t \u0219i pentru\nfurnizori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea acoperirii ciclului de via\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documenta\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>demonstr<\/span>eze <\/span>c\u0103 <\/span>securitatea <\/span>lan\u021bului <\/span>de <\/span>aprovizi<\/span>onare <\/span>este <\/span>luat\u0103 <\/span>\u00een considerare <\/span>de <\/span>la <\/span>achizi\u021bie\n<\/span>p\u00e2n\u0103 <\/span>la <\/span>scoatere <\/span>din <\/span>uz <\/span>\u0219i <\/span>dezafectare, <\/span>\u00een <\/span>special <\/span>pentru <\/span>sis<\/span>temele \u0219i componen<\/span>tele OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GV.SC-10<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Planurile <\/span>C-SCRM <\/span>includ <\/span>dispozi\u021bii\n<\/span>pentr<\/span>u <\/span>activit\u0103\u021bile <\/span>care <\/span>au <\/span>loc <\/span>dup\u0103 <\/span>\u00eencheierea <\/span>unui <\/span>parteneriat\nsau a unui contract de servicii.<\/span><\/p>\n\n

GV.SC-10.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Planurile C-SCRM trebuie s\u0103 includ\u0103\nm\u0103suri \u0219i responsabilit\u0103\u021bi <\/span>pentru\ngestionarea risc<\/span>urilor care pot\nap\u0103rea dup\u0103 \u00eencheierea unei rela\u021bii cu un furnizor sau a unui contract de\nservicii.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de\na <\/span>asigura <\/span>c\u0103 <\/span>riscurile <\/span>rez<\/span>idual<\/span>e <\/span>de <\/span>securitate\n<\/span>cibe<\/span>rnetic\u0103 <\/span>sau <\/span>a\ninforma\u021biei sunt abordate \u00een mod eficace dup\u0103 \u00eencetarea rela\u021biilor cu\nfurnizorii, prevenind astfel \u00eentreruperile<\/span>,\nexpunerea datelor \u0219i vulnerabilit\u0103\u021bile \u00een <\/span>mediile\nopera\u021bionale \u0219i OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Planificarea <\/span>\u00eencet\u0103rii <\/span>rela\u021biilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile <\/span>formale <\/span>de <\/span>\u00eencetare <\/span>a <\/span>rela\u021biilor <\/span>cu <\/span>furnizorii <\/span>ar <\/span>trebui <\/span>definite <\/span>at\u00e2t <\/span>pentru <\/span>condi\u021bii\nnormale, <\/span>c\u00e2t <\/span>\u0219i <\/span>pentru condi\u021bii <\/span>nefavorabile, <\/span>inclusiv <\/span>\u00een <\/span>caz <\/span>de <\/span>\u00eenc\u0103lcare\n<\/span>a <\/span>contractului, insolven\u021b\u0103 sau\nincidente de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea unei tranzi\u021bii sau a unei ie\u0219iri securizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>elaborate <\/span>planuri <\/span>de <\/span>tranzi\u021bie <\/span>pentru <\/span>serviciile <\/span>critice,\n<\/span>pentru <\/span>men\u021bin<\/span>erea <\/span>continuit\u0103\u021bii\n\u0219i <\/span>abordarea <\/span>rezilien\u021bei <\/span>lan\u021bului <\/span>de <\/span>aprovizionare, <\/span>inclus<\/span>iv <\/span>furnizori <\/span>de <\/span>rezerv\u0103 <\/span>sau <\/span>alternative\ninterne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revocarea accesului \u0219i securizarea datelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>furnizorilor <\/span>la <\/span>sisteme, <\/span>re\u021bele <\/span>\u0219i <\/span>date <\/span>ar <\/span>trebui <\/span>revocat <\/span>imediat.\n<\/span>T<\/span>oate <\/span>datele <\/span>de\nautentificare \u0219i instrumentele de acces la distan\u021b\u0103 ar trebui dezactivate sau\neliminate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea a<\/span>ctivelor\nor<\/span>ganiza\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitivele, <\/span>suporturile <\/span>de <\/span>stocare <\/span>\u0219i <\/span>documentele <\/span>care <\/span>con\u021bin <\/span>date <\/span>ale <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>trebui\nreturnate <\/span>\u00een <\/span>mod <\/span>securizat <\/span>sau <\/span>sanitizate. <\/span>M\u0103surile\n<\/span>de <\/span>control <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>\u00eempiedice <\/span>p\u0103strarea neautorizat\u0103 sau scur<\/span>gerea de informa\u021bii sensibile<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Abordarea obsolescen\u021bei componentelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>planuri <\/span>pentru <\/span>gestionarea <\/span>componentelor <\/span>sau <\/span>serviciilor <\/span>aflate <\/span>la <\/span>sf\u00e2r\u0219itu<\/span>l\nciclului <\/span>de <\/span>via\u021b\u0103 <\/span>(EOL), <\/span>asigur\u00e2nd <\/span>asisten\u021b\u0103 <\/span>continu\u0103 <\/span>sau <\/span>\u00eenlocuiri <\/span>securizate, <\/span>\u00een <\/span>special <\/span>pentru sistemele OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea riscurilor reziduale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Riscurile  <\/span><\/span>post-\u00eencetare  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>identificate,\n <\/span><\/span>evaluate\n <\/span><\/span>\u0219i\n <\/span><\/span>escaladate\n <\/span><\/span>c\u0103tre\n <\/span><\/span>conducerea\nsuperioar\u0103, <\/span>atunci <\/span>c\u00e2nd <\/span>es<\/span>te <\/span>necesar<\/span>. Aceste\n<\/span>riscuri <\/span>ar <\/span>trebui <\/span>urm\u0103rite <\/span>\u00een <\/span>cadrul <\/span>procesului ERM.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

IDENTIFICARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

[ID.AM]\nMANAGEMENTUL ACTIVELOR<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activele (de exemplu,\ndate, hardware, software, sisteme, incinte, servicii, persoane) care permit\norganiza\u021biei s\u0103 \u00ee\u0219i ating\u0103 scopurile act<\/span>ivit\u0103\u021bii\nsunt identificate <\/span>\u0219i <\/span>gestionate \u00een concordan\u021b\u0103 cu importan\u021ba\nlor relativ\u0103 pentru obiectivele organiza\u021biei \u0219i strategia de management al\nriscului a organiza\u021biei.<\/span><\/p>\n\n

ID.AM-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Men\u021binerea inventarelor echipamentelor hardwa<\/span>re gestionate de organiza\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Un inventar al activelor\nde infrastructur\u0103 fizic\u0103 \u0219i virtual\u0103 <\/span>–\nprecum hardw<\/span>are, dispozitive de re\u021bea\n\u0219i medii g\u0103zduite \u00een cloud – care sus\u021bin procesarea informa\u021biilor trebuie\ndocumentat, revizuit \u0219i actualizat, pe m\u0103sur\u0103 ce apar modific\u0103ri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen timp ce ID.AM-01.1 se\nconcentreaz\u0103 pe nivelul infrastructurii, acest Control este str\u00e2ns legat de ID.AM-02.1,\ncare urm\u0103re\u0219te software<\/span>-ul \u0219i\nserviciile care ruleaz\u0103 peste aceasta, precum aplica\u021bii, platforme \u0219i\ninstrumente digitale<\/span>. \u00cempreun\u0103,\nacestea ofer\u0103 o imagine complet\u0103 a mediului tehnologic al organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021biile\nar trebui s\u0103 identifice \u0219i s\u0103 documenteze toate activele fizice \u0219i <\/span>virtuale ale infrastructurii care sus\u021bin\nprocesarea informa\u021biilor<\/span>, inclusiv\nservere, sta\u021bii de lucru, dispozitive de re\u021bea, sisteme de stocare \u0219i <\/span>resurse g\u0103zduite \u00een cloud.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Inventarul  <\/span>ar \n<\/span>trebui  <\/span>s\u0103  <\/span>includ\u0103 \n<\/span>atribute  <\/span>cheie,  <\/span>precum \n<\/span>ti<\/span>pul  <\/span>de \n<\/span>activ<\/span>,  <\/span>loca\u021bia, \n<\/span>pro<\/span>prietarul, configura\u021bia \u0219i\nstarea ciclului de via\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021biile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare <\/span>utilizarea <\/span>unor <\/span>instrumente <\/span>automatizate <\/span>de <\/span>identificare \u0219i\nmanagement al activelor<\/span>, acolo unde\neste posibil, pentru asigurarea acurate\u021bei \u0219i actualiz\u0103rii \u00een timp <\/span>real.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Inventarul ar trebui revizuit \u0219i\nactualizat periodic, \u00een special dup\u0103 modific\u0103ri precum punerea \u00een func\u021biune,\nscoaterea din uz \u0219i dezafectarea sau reloc\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Inventarul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fi<\/span>e <\/span>accesibil <\/span>p\u0103r\u021bilor <\/span>intere<\/span>sate <\/span>relevante <\/span>\u0219i <\/span>ar <\/span>trebui <\/span>integra<\/span>t <\/span>\u00een <\/span>procesele de management al riscului \u0219i de\nr\u0103spuns la incidente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Inventarul <\/span>activelor <\/span>orga<\/span>niza\u021biei\n<\/span>asociate <\/span>cu <\/span>informa\u021biile <\/span>\u0219i <\/span>spa\u021biile <\/span>de <\/span>procesare <\/span>a <\/span>informa\u021biilor <\/span>trebuie s\u0103 <\/span>reflecte <\/span>modific\u0103rile <\/span>din <\/span>contextul <\/span>organiza\u021bional <\/span>\u0219i <\/span>s\u0103 <\/span>includ\u0103 toate <\/span>informa\u021biile <\/span>necesare <\/span>pentru <\/span>o\nr\u0103spundere efectiv\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>inventarele <\/span>activelor\n<\/span>sus\u021bin <\/span>transparen\u021ba <\/span>opera\u021bional\u0103, permit o proprietate\nresponsabil\u0103 \u0219i se adapteaz\u0103 la modific\u0103rile din st<\/span>ructura, tehnologia \u0219i peisajul de risc al organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea detaliilor esen\u021biale despre active<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarele ar trebui s\u0103 cuprind\u0103 specifica\u021bii <\/span>cheie, precum produc\u0103t<\/span>orul, tipul dispozitivului, modelul, <\/span>num\u0103rul\n<\/span>de <\/span>serie, <\/span>numele <\/span>ma\u0219inii, <\/span>adresa <\/span>de <\/span>re\u021bea <\/span>\u0219i <\/span>loca\u021bia\n<\/span>fizic\u0103. <\/span>Activele <\/span>OT <\/span>ar\ntrebui incluse acolo unde este cazul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea r\u0103spunderii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cenregistr\u0103rile <\/span>activelor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>permit\u0103 <\/span>trasabilitat<\/span>ea <\/span>m\u0103surilor <\/span>\u0219i <\/span>deciziilor<\/span>, <\/span>asigur\u00e2nd <\/span>c\u0103 p\u0103r\u021bile responsabile pot fi identifica<\/span>te \u0219i trase la r\u0103spundere pentru\nrezultate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Reflectarea modific\u0103rilor or<\/span>ganiza\u021bionale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarele <\/span>ar <\/span>trebui\n<\/span>actualizate <\/span>pentru <\/span>a <\/span>reflecta <\/span>modific\u0103ri <\/span>precum <\/span>relocarea <\/span>activelor<\/span>,\nactualiz\u0103ri sau scoaterea din uz \u0219i de<\/span>zafectarea,\ninclusiv cele care afecteaz\u0103 mediile OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Atunci <\/span>c\u00e2nd <\/span>este <\/span>detectat\n<\/span>hardware <\/span>neautorizat, <\/span>acesta <\/span>trebuie <\/span>pus <\/span>\u00een <\/span>carantin\u0103\n<\/span>pentru <\/span>o <\/span>eventual\u0103 gestionare a excep\u021biilor,\neliminat sau \u00eenlocuit, iar inventarul treb<\/span>uie\nactualizat \u00een consecin\u021b\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a reduce riscurile de securitate prin identificarea, izolarea\n\u0219i remedierea <\/span>prompt\u0103 <\/span>a <\/span>echipamentelor <\/span>neautoriz<\/span>ate,\nmen\u021bin\u00e2nd <\/span>\u00een <\/span>acela\u0219i <\/span>timp <\/span>un inventar <\/span>precis <\/span>al activel<\/span>or, ca<\/span>re\nasigur\u0103 r\u0103spunderea.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea <\/span>hardware-ului <\/span>neautorizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Orice  <\/span>hardware  <\/span>neaprobat \n<\/span>sau  <\/span>care  <\/span>nu \n<\/span>are  <\/span>excep\u021bii  <\/span>documentate \n<\/span>ar  <\/span>trebui  <\/span>desemnat \n<\/span>ca neautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>R\u0103spunsul la detec\u021bie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Hardware-ul <\/span>neautorizat <\/span>ar <\/span>trebui <\/span>pus <\/span>\u00een <\/span>carantin\u0103\n<\/span>pentru <\/span>revizuire, <\/span>eliminare\n<\/span>sau <\/span>\u00eenlocuire, dup\u0103 caz.\nInventarul activelor ar trebui actualizat \u00een consecin\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea considerentelor OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitivele  <\/span><\/span>neautorizate  <\/span><\/span>\u00een  <\/span><\/span>mediile  <\/span><\/span>OT  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>tratate\n <\/span><\/span>cu\n <\/span><\/span>precau\u021bie\n <\/span><\/span>sporit\u0103\n <\/span><\/span>datorit\u0103\npoten\u021bialului impact asupra siguran\u021bei \u0219i func\u021bion\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Exemple de hardware neautorizat pot include:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Endpoint-uri neaprobate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Laptop-uri, <\/span>desktop-uri <\/span>sau <\/span>dispozitive <\/span>mobile,\n<\/span>personale <\/span>sau <\/span>ne\u00eenregistrate, <\/span>conectate <\/span>la <\/span>re\u021bea f\u0103r\u0103 <\/span>autorizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dispozitive de stocare externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitive <\/span>USB <\/span>sau <\/span>hard <\/span>disk<\/span>-uri <\/span>externe\n<\/span>neaproba<\/span>te <\/span>pentru <\/span>utilizare, <\/span>care <\/span>pot <\/span>introduce riscuri de malware sau de scur<\/span>gere d<\/span>e\ndate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dispozitive de tip Internetul lucrurilor (IoT) \u0219i OT <\/span>neverifica<\/span>te<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitive  <\/span><\/span>inteligente,  <\/span><\/span>senzori  <\/span><\/span>sau  <\/span><\/span>componente\n <\/span><\/span>industriale\n <\/span><\/span>conectate\n <\/span><\/span>f\u0103r\u0103\n <\/span><\/span>o\n <\/span><\/span>verificare\nadecvat\u0103, care prezint\u0103 riscuri at\u00e2t pentru mediile IT<\/span>, c\u00e2t \u0219i pentru cele OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Echipamente de re\u021bea neautorizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Puncte <\/span>de <\/span>acces <\/span>wireless <\/span>sau <\/span>comutatoare <\/span>instalate\n<\/span>f<\/span>\u0103r\u0103 <\/span>aprobare, <\/span>care <\/span>pot <\/span>ocoli <\/span>controalele de securitate ale re\u021belei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie  <\/span><\/span>identificate  <\/span><\/span>mecanismele\n <\/span><\/span>de\n <\/span><\/span>detec\u021bie\n <\/span><\/span>a\n <\/span><\/span>prezen\u021bei\n <\/span><\/span>componentelor\n <\/span><\/span>hardware\n <\/span><\/span>\u0219i\n <\/span><\/span>firmware\nneautorizate \u00een mediul T<\/span>IC\/OT al\norganiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acest<\/span>ui Control este de a identifica proactiv\ncomponentele hardware \u0219i firmware neautorizate \u00een mediile TIC \u0219i OT, permi\u021b\u00e2nd\nastfel un r\u0103spuns prompt \u0219i reduc\u00e2nd riscul de compromite<\/span>re sau de <\/span>\u00eentrerupere\na opera\u021biunilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv<\/span>, <\/span>ar\ntrebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea acolo unde este fezabil<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mecanismele <\/span>de <\/span>detec\u021bie <\/span>ar <\/span>trebui <\/span>automatizate <\/span>acolo <\/span>unde <\/span>este <\/span>sigur <\/span>\u0219i <\/span>posibil <\/span>din <\/span>punct <\/span>de vedere tehnic, \u00een special \u00een medii\ncomplexe sau cu risc ridicat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea co<\/span>ntinu\u0103\na re\u021belelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Re\u021belele ar trebui monitorizate continuu pentru detec\u021bia\ncomponentelor hardware \u0219i firmware noi sau neautorizate. Modific\u0103rile detectate\nar trebui s\u0103 declan\u0219eze actualiz\u0103ri automate ale inventarului <\/span>activelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unui proces de <\/span>r<\/span>\u0103spuns<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>un <\/span>proces <\/span>definit\n<\/span>pentru <\/span>revizuirea <\/span>\u0219i <\/span>abordarea <\/span>periodic\u0103\n<\/span>a <\/span>componentelor neautorizate:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Pentru\nhardware neautorizat, consulta\u021bi ID.AM<\/span>-01.3;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Pentru\nfirmware neautorizat, consulta\u021bi ID.AM<\/span>-02.4.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea considerentelor specifice <\/span>OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Metodele <\/span>de <\/span>detec\u021bie\n<\/span>\u00een <\/span>mediile <\/span>OT <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare <\/span>siguran\u021ba, <\/span>disponibilitatea <\/span>\u0219i\nconstr\u00e2ngerile specifice v\u00e2nz\u0103torului atunci c\u00e2nd identific\u0103 componente\nneautorizate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Inventarele software-ului, serviciilor \u0219i sistemelor\ngestionate de organiza\u021bie sunt men\u021binute.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Un\n<\/span>inventar <\/span>al <\/span>software-ului, <\/span>serviciilor <\/span>digitale <\/span>\u0219i <\/span>sistemelor <\/span>de <\/span>gestiune <\/span>a <\/span>activit\u0103\u021bii <\/span>utilizate\n<\/span>\u00een cadrul organiza\u021biei trebuie documentat, revizuit \u0219i actual<\/span>izat pe m\u0103sur\u0103 ce apar modific\u0103ri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>identificarea, <\/span>urm<\/span>\u0103rirea\n<\/span>\u0219i <\/span>actualizarea <\/span>periodic\u0103\n<\/span>a <\/span>tuturor programelor\nsoftware, serviciilor digitale \u0219i sistemelor de gestiune a ac<\/span>tivit\u0103\u021bii utilizate \u00ee<\/span>n <\/span>cadrul\norganiza\u021biei. Se concentreaz\u0103 pe p\u0103r\u021bile func\u021bionale \u0219i intangibile ale\nmediului tehnologic, precum aplica\u021biile, platformele \u0219i serviciile cloud, care\nfunc\u021bio<\/span>neaz\u0103 pe infrastructura de\nbaz\u0103 <\/span>sau interac\u021bioneaz\u0103 cu aceasta.\nMen\u021binerea actualizat\u0103 a <\/span>acestui\ninventar sus\u021bine continuitatea opera\u021bional\u0103<\/span>,\nconsolideaz\u0103 securitatea \u0219i contribuie la \u00eendeplinirea cerin\u021belor de\nconformitate.<\/span><\/p>\n\n

Este\n<\/span>str\u00e2ns <\/span>legat <\/span>de <\/span>ID.AM<\/span>-01.1, <\/span>care <\/span>acoper\u0103\n<\/span>infrast<\/span>ructura <\/span>fizic\u0103 <\/span>\u0219i <\/span>virtual\u0103\n<\/span>(precum <\/span>servere, dispozitive\nde re\u021bea \u0219i <\/span>medii cloud) <\/span>care sus\u021bine aceste sisteme.<\/span><\/p>\n\n

\u00cempreun\u0103, <\/span>ambele <\/span>Controale <\/span>ofer\u0103 <\/span>o <\/span>imagine <\/span>complet\u0103 <\/span>a <\/span>peisajului <\/span>tehnologic\n<\/span>al <\/span>organiza\u021biei, <\/span>de <\/span>la\ninfrastructura fundamental\u0103 p\u00e2n\u0103 la aplica\u021biile \u0219i serviciile care aduc valoare\npentru activitate.<\/span><\/p>\n\n

\u00cen vederea real<\/span>iz\u0103rii\nacestui obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea software-ului \u0219i a serviciilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\n<\/span>toate <\/span>aplica\u021biile, <\/span>serviciile <\/span>cloud, <\/span>interfe\u021bele <\/span>de <\/span>progr<\/span>amare <\/span>a\naplica\u021biilor (API) \u0219i sistemele de gestiune a\n<\/span>activit\u0103\u021bii (de exemplu, planificarea resurselor or<\/span>ganiza\u021biei – ERP<\/span>, managementul rela\u021biilor cu clien\u021bii <\/span>– CRM, platforme de resurse umane).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cenregistrarea informa\u021biilor cheie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare <\/span>intra<\/span>re <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>versiunea, <\/span>proprietarul, <\/span>scopul, <\/span>tipul <\/span>de <\/span>l<\/span>icen\u021b\u0103 <\/span>\u0219i <\/span>mediul de punere \u00een func\u021biune.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea automatiz\u0103rii acolo unde este posibil<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>detec\u021bia <\/span>\u0219i <\/span>actualizarea <\/span>cu <\/span>precizie <\/span>a <\/span>software<\/span>-ului <\/span>\u0219i <\/span>serviciilor<\/span>, <\/span>ar <\/span>trebui\n<\/span>utilizate instrumente de detec\u021bie automat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unui SBOM<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>men\u021bi<\/span>nut <\/span>un <\/span>SBOM <\/span>pentru <\/span>software-ul <\/span>critic <\/span>sau <\/span>dezvoltat\n<\/span>intern, <\/span>pentru <\/span>urm\u0103rirea componentelor \u0219i dependen\u021belor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea <\/span>inventarului <\/span>actualizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarul <\/span>ar <\/span>trebui <\/span>revizuit\n<\/span>\u0219i <\/span>actualizat <\/span>periodic, <\/span>\u00een <\/span>special <\/span>dup\u0103 <\/span>instal\u0103ri, <\/span>actualiz\u0103ri <\/span>sau elimin\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea cu inventarul infrastructurii (ID.AM<\/span>-01.1)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cenregistr\u0103rile <\/span>software <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>corelate\n<\/span>cu <\/span>infrastructura <\/span>pe <\/span>care <\/span>ruleaz\u0103\n<\/span>pentru <\/span>a <\/span>oferi o imagine complet\u0103 a mediului\ntehnologic.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Inventarul care reflect\u0103\nsoftware<\/span>-ul, serviciile \u0219i <\/span>si<\/span>stemele\nutilizate \u00een organiza\u021bie trebuie s\u0103 reflecte modific\u0103rile <\/span>din <\/span>contextul <\/span>organiza\u021bional <\/span>\u0219i <\/span>s\u0103 <\/span>incl<\/span>ud\u0103 <\/span>toate <\/span>informa\u021biile <\/span>necesare\n<\/span>pentru <\/span>o <\/span>r\u0103spundere efectiv\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>inventarele <\/span>de <\/span>software,\nservicii <\/span>\u0219i <\/span>sisteme <\/span>sunt men\u021binute\nactualizate \u0219i complete, <\/span>permi\u021b\u00e2nd\ntrasabilitatea, o proprieta<\/span>te\nresponsabil\u0103 \u0219i alinierea la modific\u0103rile <\/span>din\ncontextul opera\u021bional \u0219i de risc <\/span>al\norganiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiec<\/span>tiv<\/span>,\nar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea detaliilor cheie ale inventarului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarele <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>cuprind\u0103\n<\/span>atribute <\/span>relevante <\/span>precum <\/span>titlul <\/span>software<\/span>-ului, <\/span>editorul,\n<\/span>data ini\u021bial\u0103 de instalare sau de utilizare, scopul pentru activitate, <\/span>versiunea, metoda de punere \u00een func\u021biune \u0219i\ndata scoaterii din uz. Localizatorii uniformi de resurse (URL) sau sursele din\nmagazinele de aplica\u021bii ar trebui incluse acolo unde este cazul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea r\u0103spunderii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cenregistr\u0103rile <\/span>inventarului <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>permit\u0103 <\/span>trasabilitatea <\/span>m\u0103surilor <\/span>\u0219i <\/span>a <\/span>deciziilor<\/span>, <\/span>asigur\u00e2nd\nidentificarea persoanelor responsabile \u0219i tragerea <\/span>acestora la r\u0103spundere pentru utilizarea \u0219i managementul softwa<\/span>re<\/span>-ului\n\u0219i serviciilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Reflectarea modific\u0103rilor or<\/span>ganiza\u021bionale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarele <\/span>ar <\/span>trebui <\/span>actualizate <\/span>pentru <\/span>a <\/span>reflecta\n<\/span>modific\u0103rile<\/span>, <\/span>precum <\/span>noi <\/span>puneri <\/span>\u00een <\/span>func\u021biune, actualiz\u0103ri <\/span>sau <\/span>elimin\u0103ri, <\/span>inclusiv\n<\/span>cele <\/span>care <\/span>afecteaz\u0103\n<\/span>sistem<\/span>ele <\/span>OT <\/span>\u0219i <\/span>componentele <\/span>software integrate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-02.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Persoanele <\/span>fizice <\/span>respon<\/span>sabile <\/span>\u0219i <\/span>r\u0103s<\/span>punz\u0103toare <\/span>de <\/span>gest<\/span>ionarea <\/span>platformelor <\/span>software <\/span>\u0219i <\/span>a <\/span>aplica\u021biilor\ndin cadrul organiza\u021biei trebuie identificate \u00een mod formal.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>gestionarea <\/span>corespunz\u0103toare <\/span>a <\/span>platformelor <\/span>\u0219i <\/span>aplica\u021biilor\nsoftware, prin identifi<\/span>carea clar\u0103 a\npersoanelor responsabile de opera\u021biunile zilnice \u0219i a celor r\u0103spunz\u0103toare de\nsupravegherea gene<\/span>ral\u0103 \u0219i de\nrezultate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea clar\u0103 a rolurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Persoanele <\/span>fi<\/span>zice <\/span>respo<\/span>nsabile\n<\/span>de <\/span>gestionarea <\/span>sof<\/span>tware<\/span>-ului <\/span>ar <\/span>trebui\n<\/span>desemnate <\/span>\u00een <\/span>mod formal. Acestea <\/span>sunt <\/span>persoanele <\/span>care <\/span>efectueaz\u0103 <\/span>lucr\u0103rile,\n<\/span>iau <\/span>decizii <\/span>tehnice <\/span>\u0219i <\/span>\u00eendeplinesc sarcini opera\u021bionale (de <\/span>exemplu, de<\/span>zvoltatori, administratori de sistem, personal de te<\/span>stare).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Atribuirea <\/span>r\u0103spunderii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>atribuit\u0103\n<\/span>\u00een <\/span>mod <\/span>formal <\/span>o <\/span>func\u021bie\n<\/span>separat\u0103 <\/span>pentru <\/span>supravegherea <\/span>\u0219i <\/span>aprobarea\nfinaliz\u0103rii <\/span>cu <\/span>succes <\/span>a <\/span>sarcinilor <\/span>legate <\/span>de <\/span>software. Aceasta <\/span>ar <\/span>putea <\/span>include\n<\/span>manageri <\/span>de proiect,\nproprietari de produse sau <\/span>conduc\u0103tori\nde echipe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea <\/span>principiului <\/span>\u00een <\/span>toate <\/span>mediile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>roluri <\/span>ar <\/span>trebui <\/span>definite <\/span>at\u00e2t <\/span>pentru <\/span>mediile <\/span>IT<\/span>, <\/span>c\u00e2t <\/span>\u0219i <\/span>pentru <\/span>cele <\/span>OT<\/span>, <\/span>asigur\u00e2ndu<\/span>-se <\/span>c\u0103 software-ul <\/span>utilizat <\/span>\u00een <\/span>sistemele <\/span>industriale <\/span>este, <\/span>de <\/span>asemenea, <\/span>gestionat <\/span>\u00een <\/span>mod <\/span>corespunz\u0103tor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-02.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Atunci <\/span>c\u00e2nd <\/span>este <\/span>detectat\n<\/span>software <\/span>neautorizat, <\/span>acesta <\/span>trebuie <\/span>pus <\/span>\u00een <\/span>carantin\u0103\n<\/span>pentru <\/span>eventuala gestionare a\nexcep\u021biilor, eliminare sau \u00eenlocuire, iar inventarul trebuie actualizat \u00een\nconsecin\u021b\u0103. GHID DE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>minimiza\n<\/span>riscurile <\/span>de <\/span>securitate, <\/span>opera\u021bionale <\/span>\u0219i <\/span>de <\/span>conformitate,\nasigur\u00e2nd c\u0103 software-ul neautorizat este identificat prom<\/span>pt, gestionat \u00een mod corespunz\u0103tor \u0219i\nreflectat \u00een inventarul de software al organiza\u021biei.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui <\/span>obiectiv,\nar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea software-ului neautorizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software-ul  <\/span> <\/span><\/span>instalat  <\/span> <\/span><\/span>sau \n<\/span> <\/span><\/span>utilizat  <\/span> <\/span><\/span>f\u0103r\u0103 \n<\/span> <\/span><\/span>licen\u021b\u0103,  <\/span> <\/span><\/span>aprobare  <\/span> <\/span><\/span>sau \n<\/span> <\/span><\/span>ex<\/span>cep\u021bii  <\/span> <\/span><\/span>documentate corespunz\u0103toare ar trebu<\/span>i clasificat ca neautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cen\u021belegerea riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software-ul\nneautorizat poate introduce:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>V<\/span>ulnerabilit\u0103\u021bi de securitate (de exemplu,\nmalware sau backdoor<\/span>-uri).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Riscuri\nlegate de protec\u021bia datelor (de <\/span>exemplu,\npr<\/span>elucrarea neautorizat\u0103 a <\/span>datelor).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Ineficien\u021be\nopera\u021bionale (de exemplu, probleme de compatibilitate).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Pierderea\ncontrolului asupra utiliz\u0103rii \u0219i actualiz\u0103rii software<\/span>-ului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea procedurilor de r\u0103spuns<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software-ul <\/span>neautorizat <\/span>ar <\/span>trebui <\/span>pus <\/span>\u00een <\/span>carantin<\/span>\u0103 <\/span>pentru <\/span>eventuala <\/span>gestionare <\/span>a <\/span>excep\u021biilor<\/span>, eliminat sau \u00eenlocuit. Inventarul <\/span>software-ului ar trebui actualizat \u00een\nconsecin\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijin prin management centralizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>un <\/span>proces <\/span>centralizat <\/span>de <\/span>manag<\/span>ement <\/span>al <\/span>software<\/span>-ului <\/span>pentru <\/span>supravegherea\nselec\u021biei v\u00e2nz\u0103torilor v\u00e2nz\u0103torilor<\/span>,\nsoftware-ului vechi \u0219i controalelor de <\/span>securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea SBOM-urilor acol<\/span>o unde este cazul<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>SBOM-urile <\/span>ar <\/span>trebui\n<\/span>utilizate <\/span>pentru <\/span>urm\u0103rirea <\/span>componentelor<\/span>, <\/span>bibliotecilor <\/span>\u0219i <\/span>modulelor<\/span>, sprijinind <\/span>conformitatea licen\u021belor <\/span>\u0219i <\/span>managementul <\/span>vulnerabilit\u0103\u021bilor<\/span>, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>sistemele\nOT <\/span>\u0219i integrate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-02.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>identificate <\/span>mecanisme <\/span>pentru <\/span>detec\u021bia <\/span>prezen\u021bei <\/span>software<\/span>-ului <\/span>ne<\/span>autorizat <\/span>\u00een <\/span>mediul <\/span>TIC\/OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

al organiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nasigura existen\u021ba <\/span>unor mecanisme <\/span>pentru <\/span>detec\u021bia <\/span>software<\/span>-ului\nneautorizat <\/span>\u00een <\/span>mediile <\/span>T<\/span>IC <\/span>\u0219i <\/span>OT, <\/span>permi\u021b\u00e2nd\nastfel <\/span>un r\u0103spuns <\/span>prompt <\/span>\u0219i <\/span>men\u021binerea <\/span>unui <\/span>inventar software\nprecis.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea acolo unde este fezabil<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mecanismele <\/span>de <\/span>detec\u021bie <\/span>ar <\/span>trebui <\/span>automatizate <\/span>acolo <\/span>unde <\/span>este <\/span>sigur <\/span>\u0219i <\/span>adecvat <\/span>din <\/span>punct <\/span>de vedere tehnic, \u00een special \u00een medii\ncomplexe sau cu risc ridicat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea tuturor platformelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate platformele, inclusiv sistemele fizice, <\/span>ma\u0219inile virtuale (VM), <\/span>containerele \u0219i sistemele OT integrate, <\/span>ar <\/span>trebui <\/span>monitorizate <\/span>continuu <\/span>pentru <\/span>detec\u021bia <\/span>software<\/span>-ului <\/span>nou <\/span>sau neautorizat. Modific\u0103rile detectate ar\ntrebui s\u0103 declan\u0219eze actual<\/span>iz\u0103ri\nautomate ale inventarului de software.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unui proces de <\/span>revizuire<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>instituit  <\/span><\/span>un  <\/span><\/span>proces\n <\/span><\/span>pentru\n <\/span><\/span>investigarea\n <\/span><\/span>\u0219i\n <\/span><\/span>abordarea\n <\/span><\/span>periodic\u0103\n <\/span><\/span>a\n <\/span><\/span>software<\/span>-ului neautorizat. <\/span>Atunci c\u00e2nd se detecteaz<\/span>\u0103\nsoftware neautorizat, ar trebui aplicat ID.AM<\/span>-02.4.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Adaptarea detec\u021biei la mediile OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen  <\/span><\/span>mediile  <\/span><\/span>OT<\/span>,  <\/span><\/span>mecanismele  <\/span><\/span>de  <\/span><\/span>detec\u021bie  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>adaptate\n <\/span><\/span>pentru\n <\/span><\/span>evitarea\n <\/span><\/span>\u00eentreruperii\nopera\u021bionale<\/span>. Pentru asigurarea\nsiguran\u021bei \u0219i disponibilit\u0103\u021bii sistemului, ar trebui considerat\u0103 monitorizarea\npasiv\u0103, instrumentele aprobate de <\/span>v\u00e2nz\u0103tori\n\u0219i scan\u0103rile programate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Men\u021binerea <\/span>reprezent\u0103rilor <\/span>comunica\u021biilor <\/span>de <\/span>re\u021bea <\/span>autorizate <\/span>ale <\/span>organiza\u021biei <\/span>\u0219i <\/span>ale <\/span>flu<\/span>xurilor <\/span>de <\/span>date\nde re\u021bea interne \u0219i externe.<\/span><\/p>\n\n

ID.AM-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Comunicare<\/span>a <\/span>\u00een <\/span>re\u021bea <\/span>\u0219i <\/span>fluxurile\n<\/span>de <\/span>date <\/span>inter<\/span>ne <\/span>ale <\/span>organiza\u021biei <\/span>trebuie <\/span>identificate, <\/span>documentate, autorizate \u0219i actualizate at<\/span>unci c\u00e2nd apar modific\u0103ri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>comunica\u021biile <\/span>interne\n<\/span>de <\/span>re\u021bea <\/span>\u0219i <\/span>fluxurile <\/span>de <\/span>date <\/span>sunt \u00een\u021belese \u00een mod clar, documentate\ncorespunz\u0103tor \u0219i actualizate, pent<\/span>ru a\nsprijini opera\u021biuni <\/span>securizate \u0219i\nluarea de decizii informate \u00een mediile TIC \u0219i O<\/span>T.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unor valori de referin\u021b\u0103 pentru re\u021bea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fluxurile <\/span>de <\/span>comunica\u021bii <\/span>\u0219i <\/span>date <\/span>prin <\/span>infrastructura <\/span>cu <\/span>fir<\/span>, <\/span>wireless <\/span>\u0219i <\/span>bazat\u0103 <\/span>pe <\/span>cloud <\/span>(de exemplu, <\/span>infrastructur\u0103 ca <\/span>serviciu <\/span>– <\/span>IaaS) <\/span>ar <\/span>trebui <\/span>identificate, <\/span>docume<\/span>ntate <\/span>\u0219i <\/span>autorizate.\nActualiz\u0103rile ar trebui efectuate atunci c\u00e2nd apar modific\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea detaliilor tehnice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Porturile <\/span>de <\/span>re\u021bea, <\/span>proto<\/span>coalele\n<\/span>\u0219i <\/span>serviciile <\/span>a\u0219teptate, <\/span>utilizate <\/span>\u00eentre <\/span>sistemele\n<\/span>autorizate, <\/span>ar trebui\n\u00eenregistrate pentru facilitarea monitoriz\u0103rii \u0219i depan\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu managementul configura\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesele  <\/span><\/span>de  <\/span><\/span>management  <\/span><\/span>al  <\/span><\/span>configura\u021biei  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>sprijine\n <\/span><\/span>men\u021binerea\n <\/span><\/span>\u0219i\n <\/span><\/span>vali<\/span>darea documenta\u021biei privind fl<\/span>uxul de re\u021bea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea <\/span>unei <\/span>documenta\u021bii <\/span>reziliente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documenta\u021bia <\/span>privind <\/span>fluxul <\/span>de <\/span>re\u021bea <\/span>ar <\/span>trebui <\/span>stocat\u0103 <\/span>\u00een <\/span>mod <\/span>securizat\n<\/span>\u0219i <\/span>nu <\/span>numai <\/span>pe <\/span>re\u021beaua pe <\/span>care <\/span>o <\/span>descrie.\n<\/span>Ar <\/span>trebui <\/span>men\u021binut\u0103\n<\/span>o <\/span>copie <\/span>of<\/span>fline <\/span>protejat\u0103\n<\/span>(de <\/span>exemplu<\/span>, <\/span>unitate <\/span>extern\u0103 criptat\u0103 sau copie tip\u0103rit\u0103) pentru\nasigurarea disponibilit\u0103\u021bii \u00een cazul \u00eentreruperilor sau incidentelor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-03.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Comunicare<\/span>a \u00een re\u021bea \u0219i fluxurile de date externe\nale organiza\u021biei trebuie identificate, documentate, autorizate \u0219i act<\/span>ualizate atunci c\u00e2nd apar modific\u0103ri.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 comunica\u021biile externe de re\u021bea sunt \u00een\u021belese \u00een mod clar, controlate\n\u0219i monitorizate, pentru reducerea riscului de acces neautorizat, <\/span>scurgeri de date sau \u00eentreruperea\nserviciilor \u00een <\/span>mediile TIC \u0219i OT.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea \u0219i documentarea fluxurilor externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunicare<\/span>a <\/span>\u0219i <\/span>fluxurile <\/span>de <\/span>date <\/span>\u00eentre\n<\/span>or<\/span>ganiza\u021bie <\/span>\u0219i <\/span>p<\/span>\u0103r\u021bile\n<\/span>externe <\/span>ar <\/span>trebui\n<\/span>identificate, documentate <\/span>\u0219i <\/span>autorizate. <\/span>Aceste <\/span>\u00eenregistr\u0103ri <\/span>ar <\/span>trebui <\/span>actualizate <\/span>atunci <\/span>c\u00e2nd <\/span>apar <\/span>modific\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na controalelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conexiunile <\/span>de <\/span>re\u021bea <\/span>ar <\/span>trebui <\/span>res<\/span>tric\u021bionate <\/span>la <\/span>interfe\u021bele <\/span>au<\/span>torizate <\/span>\u00een <\/span>mod <\/span>explicit,\n<\/span>pentru reducerea suprafe\u021bei de atac \u0219i prevenirea transferurilor\nneautorizate de date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Intensificarea monitoriz\u0103<\/span>rii atunci c\u00e2nd este necesar<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea <\/span>ar <\/span>trebui <\/span>intensificat\u0103 <\/span>ca <\/span>r\u0103spuns <\/span>la <\/span>nivelurile <\/span>ridicate\n<\/span>de <\/span>risc. <\/span>Aceasta\n<\/span>ar <\/span>putea include alerte \u00een\ntimp real, jurnalizare intensific<\/span>at\u0103\nsau audituri mai frecvente ale activit\u0103\u021bii re\u021belei <\/span>externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Prevenirea scur<\/span>gerilor\nde informa\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Riscul <\/span>de <\/span>scur<\/span>gere <\/span>de <\/span>date <\/span>prin <\/span>emisii <\/span>electromagnetice <\/span>sau <\/span>atacuri <\/span>de <\/span>tip <\/span>side<\/span>-channel <\/span>ar trebui <\/span>evaluat. <\/span>Dup\u0103 <\/span>caz, <\/span>ar <\/span>trebui aplicate <\/span>m\u0103suri <\/span>de <\/span>atenuare,\n<\/span>pentru <\/span>securitatea <\/span>emisiilor electromagnetice <\/span>(EMSEC) <\/span>sau\nTEMPEST<\/span>, <\/span>\u00een <\/span>special <\/span>pentru <\/span>sistemele <\/span>care <\/span>gestioneaz\u0103\ninforma\u021bii sensibile sau clasificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Cele dou\u0103 Controale <\/span>– ID.AM-03.3 \u0219i ID.AM-04.2 – sunt str<\/span>\u00e2ns corelate, dar se concentreaz\u0103 pe\ndomenii <\/span>diferite <\/span>ale <\/span>fluxului <\/span>de <\/span>informa\u021bii <\/span>\u0219i <\/span>ale <\/span>activit\u0103\u021bii re\u021belei. <\/span>Controlul <\/span>ID.AM<\/span>-03.3 <\/span>acoper\u0103\ninterac\u021biunile la nivel de re\u021bea cu entit\u0103\u021bi externe, inclusiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>raficul <\/span>de <\/span>internet\n<\/span>(de <\/span>exemplu, <\/span>accesul\n<\/span>web <\/span>de <\/span>ie\u0219<\/span>ir<\/span>e, <\/span>interog\u0103ri <\/span>ale <\/span>sistemului <\/span>de <\/span>nume <\/span>de domenii – D<\/span>NS, traficul de e-mail).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Conexiunile <\/span>de <\/span>re\u021bea <\/span>virtual\u0103 <\/span>privat\u0103\n<\/span>(VPN), <\/span>accesul <\/span>la <\/span>distan\u021b\u0103 <\/span>\u0219i <\/span>comunica\u021biile <\/span>prin <\/span>servicii\ncloud.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Orice <\/span>comunicare <\/span>care <\/span>traverseaz\u0103 <\/span>perimetrul\n<\/span>or<\/span>ganiza\u021bional, <\/span>indiferent\n<\/span>dac\u0103 <\/span>implic\u0103 <\/span>un <\/span>sistem\nextern specific.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Inventarele <\/span>serviciilor <\/span>furnizate <\/span>de <\/span>f<\/span>urnizori\n<\/span>sunt <\/span>men\u021binute.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021biil<\/span>e trebuie s\u0103 p\u0103streze <\/span>o list\u0103 clar\u0103 \u0219i actualizat\u0103 a tuturor\nserviciilor externe pe care le utilizeaz\u0103, inclusiv modul \u00een <\/span>care acestea se conecteaz\u0103 la sistemele\nlor. Aceste servicii trebuie revizuite \u0219i aprobate \u00eenainte de utilizare, iar\nlista trebuie actualizat\u0103 ori de c\u00e2te ori apar modific\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\nc\u0103 <\/span>toate <\/span>servi<\/span>ciile <\/span>externe <\/span>utilizate <\/span>de <\/span>organiza\u021bie <\/span>sunt identificate \u00een mod clar, revizuite \u0219i\nactualizate, pentru reducerea riscului de acces neautorizat, dependen\u021be <\/span>fa\u021b\u0103 <\/span>de <\/span>p\u0103r\u021bi <\/span>ter\u021be <\/span>care <\/span>nu <\/span>sunt <\/span>gestionate <\/span>sau <\/span>\u00eentreruperea <\/span>serviciilor <\/span>\u00een <\/span>mediile <\/span>TIC \u0219i OT.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unui inventar al serviciilor externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>serviciile <\/span>externe <\/span>pe <\/span>care <\/span>se <\/span>bazeaz\u0103\n<\/span>or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>identific<\/span>ate <\/span>\u0219i <\/span>documentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceasta <\/span>include <\/span>serviciile <\/span>utilizat<\/span>e <\/span>at\u00e2t <\/span>\u00een <\/span>mediile <\/span>IT<\/span>, <\/span>c\u00e2t <\/span>\u0219i <\/span>\u00een <\/span>cele <\/span>OT<\/span>. <\/span>Inventarul <\/span>ar <\/span>trebui\nactualizat ori de c\u00e2te ori sunt ad\u0103ugate, modificate sau elimin<\/span>ate servicii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Descrierea \u0219i identificarea conexiunilor serviciilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modul <\/span>\u00een <\/span>care <\/span>fiecare <\/span>serviciu\n<\/span>extern <\/span>se <\/span>conecteaz\u0103 <\/span>la <\/span>sistemele <\/span>interne\n<\/span>ar <\/span>trebui <\/span>descris\n<\/span>\u0219i \u00eenregistrat \u00een mod clar<\/span>. <\/span>Aceasta include instrume<\/span>nte de acces la distan\u021b\u0103, platforme de\ncontrol de <\/span>supraveghere <\/span>\u0219i <\/span>achizi\u021bie <\/span>de <\/span>date <\/span>(SCADA) <\/span>bazate <\/span>pe <\/span>cloud <\/span>\u0219i <\/span>sisteme <\/span>OT gestionate <\/span>de v\u00e2nz\u0103tori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i aprobarea serviciilor \u00eenainte de\nutilizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Serviciile <\/span>externe <\/span>ar <\/span>trebui <\/span>revizuite <\/span>\u0219i <\/span>aprobate <\/span>\u00eenainte\n<\/span>de <\/span>a <\/span>fi <\/span>utilizate. <\/span>Acest <\/span>proces <\/span>ar <\/span>trebui\ns\u0103 <\/span>verifice dac\u0103 <\/span>serviciul\n<\/span>respect\u0103 <\/span>cerin\u021bele <\/span>interne <\/span>de <\/span>securitate, <\/span>de <\/span>conformitate <\/span>\u0219i opera\u021bionale<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Categorizarea \u0219i clasificarea serviciilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Serviciile <\/span>externe <\/span>ar <\/span>tr<\/span>ebui <\/span>categorizate <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>tip <\/span>(de <\/span>exemplu, <\/span>IaaS,\n<\/span>software <\/span>ca serviciu <\/span>– <\/span>S<\/span>aaS, API) <\/span>\u0219i <\/span>clasificate <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>criticitatea <\/span>lor <\/span>\u0219i <\/span>de <\/span>sensibilitatea <\/span>datelor<\/span>.\nAceasta faciliteaz\u0103 priori<\/span>tizarea\neforturilor de supraveghere \u0219i management al riscului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu managementul riscului \u0219i al\nmodific\u0103rilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarul  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>integrat  <\/span><\/span>\u00een  <\/span><\/span>procesele\n <\/span><\/span>mai\n <\/span><\/span>ampl<\/span>e  <\/span><\/span>de  <\/span><\/span>management  <\/span><\/span>al  <\/span><\/span>riscului  <\/span><\/span>\u0219i  <\/span><\/span>al modific\u0103rilor<\/span>. <\/span>Orice <\/span>modificare a <\/span>serviciilor <\/span>externe <\/span>ar <\/span>treb<\/span>ui <\/span>s\u0103 <\/span>declan\u0219eze <\/span>o <\/span>revizuire <\/span>a riscurilor asociate \u0219i a controalelor\nnecesare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-04.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>identifice, <\/span>s\u0103 <\/span>documenteze <\/span>\u0219i <\/span>s\u0103 <\/span>autorizeze <\/span>fluxul <\/span>de <\/span>informa\u021bii <\/span>c\u0103tre\/dinspre sistemele externe \u0219i s\u0103 actualizeze fluxul atunci\nc\u00e2nd apar mo<\/span>dific\u0103ri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 fluxul de informa\u021bii c\u0103tre \u0219i dinspre sistemele\nexterne este <\/span>\u00een\u021beles <\/span>\u00een <\/span>mod <\/span>clar, <\/span>gestionat <\/span>\u00een <\/span>mod <\/span>securiz<\/span>at <\/span>\u0219i <\/span>actualizat, <\/span>pentru <\/span>reducerea <\/span>riscului\n<\/span>scurgerii <\/span>de date, al\naccesului neautorizat sau al \u00eentreruperilor \u00een mediile <\/span>TIC \u0219i OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea \u0219i cartografierea c\u0103ilor de acces la\ndate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>c\u0103ile <\/span>prin <\/span>care <\/span>datele <\/span>intr\u0103 <\/span>sau <\/span>ies <\/span>din <\/span>sistemel<\/span>e <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>tr<\/span>ebui <\/span>identificate <\/span>\u0219i documentate. Aceasta <\/span>include\n<\/span>func\u021bi<\/span>ile, <\/span>porturile, <\/span>protocoalele <\/span>\u0219i <\/span>serviciile <\/span>utilizate <\/span>at\u00e2t <\/span>\u00een mediile IT<\/span>, c\u00e2t \u0219i \u00een cele OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u00een detaliu a fluxurilor de date<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cenregistr\u0103rile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>descrie <\/span>tipuril<\/span>e <\/span>de <\/span>date <\/span>transferate, <\/span>sistemele\n<\/span>implicate <\/span>\u0219i <\/span>m\u0103surile de \n<\/span>securitate  <\/span>aplicate  <\/span>(de \n<\/span>exemplu,  <\/span>criptare,  <\/span>autentificare,  <\/span>controale \n<\/span>de  <\/span>acces). <\/span>Aceasta contribuie la transparen\u021b\u0103 \u0219i gestionarea securizat\u0103 a\ndatelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Autorizarea <\/span>\u0219i <\/span>controlul <\/span>accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Numai <\/span>personalul <\/span>desemnat\n<\/span>\u0219i <\/span>autorizat <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>dreptul\n<\/span>de <\/span>a <\/span>aproba <\/span>\u0219i <\/span>gestiona transferurile  <\/span>de \n<\/span>date. <\/span>Aceasta  <\/span>contribuie \n<\/span>la  <\/span>prevenirea  <\/span>accesului \n<\/span>neautorizat  <\/span>\u0219i  <\/span>asigur\u0103 r\u0103spunderea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i actualizarea periodic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documenta\u021bia <\/span>privind <\/span>fl<\/span>uxul <\/span>de <\/span>inf<\/span>orma\u021bii\n<\/span>ar <\/span>trebui <\/span>revizuit\u0103\n<\/span>\u0219i <\/span>actualizat\u0103 <\/span>ori <\/span>de <\/span>c\u00e2te <\/span>ori <\/span>se modific\u0103 <\/span>sistemele, <\/span>proce<\/span>sele <\/span>sau <\/span>conexiunile <\/span>externe. <\/span>Aceasta <\/span>asigur\u0103\n<\/span>men\u021binerea <\/span>eficacit\u0103\u021bii\ncontroalelor \u0219i alinierea acestora la mediul actual.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Cele\n<\/span>dou\u0103 <\/span>Controale <\/span>– <\/span>ID.AM-03.3 <\/span>\u0219i <\/span>ID.AM-04.2 <\/span>– <\/span>sunt <\/span>str\u00e2ns\n<\/span>legate, <\/span>dar <\/span>se <\/span>concentreaz\u0103 <\/span>pe <\/span>domenii\ndiferite <\/span>ale <\/span>fluxului <\/span>de <\/span>informa\u021bii <\/span>\u0219i <\/span>activit<\/span>\u0103\u021bii <\/span>re\u021belei. <\/span>Acest Control <\/span>se <\/span>concentreaz\u0103 <\/span>pe <\/span>fluxurile <\/span>de date granulare, specifice con\u021binutul<\/span>ui, \u00eentre organiza\u021bie \u0219i anumite sisteme\nexterne. Acesta inc<\/span>lude:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>ransferuri <\/span>de <\/span>date <\/span>c\u0103tre\/de <\/span>la <\/span>platforme <\/span>ter\u021be, <\/span>precum <\/span>sisteme\n<\/span>CRM, <\/span>furnizori <\/span>de <\/span>servicii <\/span>de stocare \u00een cloud \u0219i <\/span>API<\/span>-uri\nexterne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>ransferuri de fi\u0219iere, apeluri <\/span>API\n\u0219i sinc<\/span>ronizarea bazelor de date cu\nsisteme externe.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activele sun<\/span>t\nprior<\/span>itizate pe baza clasific\u0103rii,\ncriticit\u0103\u021bii, resurselor \u0219i impactului asupra misiunii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activele  <\/span><\/span>organiza\u021biei  <\/span><\/span>tr<\/span>ebuie  <\/span><\/span>priori<\/span>tizate\n <\/span><\/span>\u00een\n <\/span><\/span>func\u021bie\n <\/span><\/span>de\n <\/span><\/span>clasificare,\n <\/span><\/span>criticitate\n <\/span><\/span>\u0219i\n <\/span><\/span>valoare\n <\/span><\/span>pentru\nactivitate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui <\/span>Control este de a asigura c\u0103 toate\nactivele organiza\u021biei, precum dispozitivele, sistemele, <\/span>serviciile, <\/span>datele <\/span>\u0219i <\/span>procesele <\/span>organiza\u021biei, <\/span>sunt <\/span>prioritizate \u00een <\/span>func\u021bie <\/span>de <\/span>clasificarea, criticitatea \u0219i valoarea\npentru activitate.<\/span><\/p>\n\n

Aceast\u0103 <\/span>pri<\/span>oritizare <\/span>contribuie <\/span>la <\/span>direc\u021bionarea <\/span>eforturilor <\/span>de <\/span>protec\u021bie <\/span>c\u0103tre <\/span>cele <\/span>mai <\/span>importante\nactive, sprijinind continuitatea opera\u021bional\u0103, securitatea \u0219i conformitatea.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea activelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>activele <\/span>relevante, <\/span>inclusiv <\/span>dispozitivele, <\/span>sistemele, <\/span>software<\/span>-ul, <\/span>serviciile <\/span>cloud, <\/span>datele,\nangaja\u021bii \u0219i procesele or<\/span>ganiza\u021biei,\nar trebui identificate \u0219i \u00eenregistrate \u00eentr-un inventar centralizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Clasificarea <\/span>activelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare\nactiv ar trebui clasificat \u00een func\u021bie de rolul s\u0103u:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Activele <\/span>primare\n<\/span>ar <\/span>trebui <\/span>definite\n<\/span>ca <\/span>fiind <\/span>cele <\/span>care <\/span>sus\u021bin\n<\/span>\u00een <\/span>mod <\/span>direct <\/span>func\u021biile <\/span>de <\/span>baz\u0103\nale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Activele <\/span>secundare\n<\/span>ar <\/span>tr<\/span>ebui <\/span>definite <\/span>ca <\/span>fiind <\/span>cele <\/span>care <\/span>sus\u021bin,\n<\/span>protejeaz\u0103 <\/span>sau <\/span>permit func\u021bionarea <\/span>activelor primare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea criticit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>evalueze <\/span>c\u00e2t <\/span>de <\/span>critic <\/span>este <\/span>fiecare\n<\/span>activ <\/span>pentru <\/span>continuitatea <\/span>activit\u0103\u021bii<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluarea  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>considere  <\/span><\/span>impactul\n <\/span><\/span>poten\u021bial,\n <\/span><\/span>precum\n <\/span><\/span>\u00eentreruperea\n <\/span><\/span>opera\u021bional\u0103,\npierderile fi<\/span>nanciare, consecin\u021bele l<\/span>egale sau de reglementare, riscurile de\nsiguran\u021b\u0103 \u0219i prejudiciile aduse reputa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Metoda de prioritizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>utilizat\u0103  <\/span><\/span>o  <\/span><\/span>metod\u0103\n <\/span><\/span>consecvent\u0103\n <\/span><\/span>de\n <\/span><\/span>notare\n <\/span><\/span>sau\n <\/span><\/span>ierarhizare\n <\/span><\/span>pentru\n <\/span><\/span>prioritizarea\nactivelor \u00een func\u021bie de clasificare, criticitate \u0219i valoare p<\/span>entru activitate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Atribuirea propriet\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare <\/span>activ\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>un <\/span>proprietar <\/span>desemnat, <\/span>responsabil <\/span>cu <\/span>men\u021binerea <\/span>informa\u021biilor exacte \u0219i actualizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea p<\/span>eriodic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Clasific\u0103rile <\/span>\u0219i <\/span>priorit\u0103\u021bile <\/span>activelor <\/span>ar <\/span>trebui\n<\/span>revizuite <\/span>cel <\/span>pu\u021bin\n<\/span>anua<\/span>l <\/span>sau <\/span>atunci <\/span>c\u00e2nd <\/span>apar\nmodific\u0103ri semnificative (de exemplu, sisteme noi, restructurarea or<\/span>ganiza\u021biei).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documenta\u021bie \u0219i dovezi<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Registrul <\/span>activelor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>clasificarea, <\/span>criteriile <\/span>de <\/span>prioritizare, <\/span>proprietarii desemna\u021bi \u0219i dovezi <\/span>ale <\/span>revizuirilor\nperiodice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Defini\u021biile\nactivelor primare \u0219i secundare ar treb<\/span>ui\ndocumentate \u00een mod clar<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-07<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Inventarele <\/span>datelor\n\u0219i metadatelor corespunz\u0103toare pentru tipurile de date desemnate sunt\nmen\u021binute.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-07.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Datele pe care <\/span>organiza\u021bia\nle stocheaz\u0103 \u0219i le utilizeaz\u0103 trebuie identificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 toate datele stocate \u0219i utilizate de organiza\u021bie\nsunt identificate \u00een mod clar. Aceasta sprijin\u0103 managementul \u0219i protec\u021bia <\/span>corespunz\u0103toare a datelor, precum \u0219i\nalinierea la cerin\u021bele organiza\u021bionale \u0219i de reglementare.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea datelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>tipurile <\/span>de <\/span>date, <\/span>indiferent <\/span>de <\/span>format, <\/span>loca\u021bie \n<\/span>sau <\/span>sistem, <\/span>ar <\/span>tr<\/span>ebui <\/span>identificate <\/span>\u0219i \u00eenregistrate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Clasificarea <\/span>datelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele\nidentificate ar trebui clasificate utiliz\u00e2nd categorii standard, precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Publice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Interne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Confiden\u021biale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Restric\u021bionate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Corelarea datelor cu activele<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>ar <\/span>tr<\/span>ebui <\/span>s\u0103 <\/span>fie <\/span>corelate\n<\/span>cu <\/span>activele <\/span>care <\/span>le <\/span>stocheaz\u0103\n<\/span>sau <\/span>le <\/span>prelucreaz\u0103, <\/span>inclusiv\ndispozitivele fizice, sistemele, softwa<\/span>re<\/span>-ul \u0219i aplica\u021biile enumerate \u00een\ninventarele din ID.AM<\/span>–<\/span><\/p>\n\n

01 \u0219i ID.AM-02.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i men\u021binerea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ipurile de date, clasific\u0103rile \u0219i activele asocia<\/span>te ar trebui documentate \u0219i actualizate\nperiodic pentru reflectarea modific\u0103rilor din mediu.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-07.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Inventarele de date \u0219i metadatele asociate trebuie\nmen\u021binute pentru tipuri<\/span>le de date desemnate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>men\u021binerea <\/span>inventarelor <\/span>de <\/span>date <\/span>\u0219i <\/span>a <\/span>metadatelor <\/span>asociate pentru toate tipurile de date <\/span>selectate sau desemnate \u00een mod explicit\nprin politici sau orient\u0103ri (de exemplu, datele clien\u021bilor, informa\u021biile\nfinanciare sau datele de produc\u021bie), \u00een vede<\/span>rea\nsus\u021binerii managementului <\/span>securizat <\/span>al <\/span>datelor, <\/span>conformit\u0103<\/span>\u021bii <\/span>cu <\/span>reglement\u0103rile <\/span>\u0219i <\/span>integrit\u0103\u021bii <\/span>opera\u021bionale \u00een mediile TIC \u0219i OT.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea unei scheme de clasificare a datelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>stabilit\u0103\n<\/span>o <\/span>schem\u0103 <\/span>de <\/span>clasificare <\/span>pentru <\/span>categorizarea <\/span>tipurilor\n<\/span>de <\/span>date <\/span>\u00een <\/span>func\u021bie <\/span>de sensibilitate <\/span>\u0219i <\/span>de <\/span>modul\n<\/span>de <\/span>utilizare. <\/span>Aceast\u0103\n<\/span>schem\u0103 <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>ghideze <\/span>modul\n<\/span>\u00een <\/span>care <\/span>datele sunt gestionate, protejate \u0219i\np\u0103strate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea m\u0103surilor de securitate \u00een func\u021bie de\nnivelul de clasificare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>fiecare\n<\/span>nivel <\/span>de <\/span>clasificare <\/span>ar <\/span>trebui <\/span>implementate <\/span>controale <\/span>de <\/span>securitate <\/span>adecvate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acestea <\/span>ar <\/span>putea <\/span>include\n<\/span>criptarea, <\/span>control <\/span>al <\/span>accesului <\/span>bazat\n<\/span>pe <\/span>roluri <\/span>(RBAC)\n<\/span>\u0219i <\/span>politi<\/span>ci personalizate de p\u0103strare a datelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea \u0219i protejarea tipurilor de date\nsensibile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarele <\/span>ar trebui s\u0103 includ\u0103 date sensibile,\nprecum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Informa\u021bii\nde identificare a persoanei (PII).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Informa\u021bii <\/span>financiare <\/span>\u0219i <\/span>medicale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Date\nconfiden\u021biale ale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Proprietate\nintelectual\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>\u00cenregistr\u0103ri\nguvernamen<\/span>tale \u0219i de personal.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mediile\nOT <\/span>ar trebui s\u0103 includ\u0103 \u0219i date\nopera\u021bionale critice pentru siguran\u021b\u0103 \u0219i fiabilitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Urm\u0103rirea metadatelor pentru fiecare instan\u021b\u0103 de date<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Metadatele\nar trebui men\u021binute pentru sprijinirea guvernan\u021bei datelor<\/span>. <\/span>Acestea\ninclud:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Metadate\ndescriptive (de exemplu, titlu, autor<\/span>,\ncuvinte cheie).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Metadate\nstructurale (de exemplu, format, schem\u0103).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Metadate\nadministrative (de exemplu, drepturi de acces, poli<\/span>ti<\/span>c\u0103 de p\u0103strare).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Metadate\ntehnice (de ex<\/span>emplu, codificare,\nsum\u0103 de control).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea provenien\u021bei \u0219i localiz\u0103rii datelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Originea,  <\/span><\/span>proprietatea  <\/span><\/span>\u0219i  <\/span><\/span>localizarea  <\/span><\/span>geografic\u0103\n <\/span><\/span>a\n <\/span><\/span>fiec\u0103rei\n <\/span><\/span>instan\u021be\n <\/span><\/span>de\n <\/span><\/span>date\n <\/span><\/span>ar\n <\/span><\/span>trebui\ndocumentate. <\/span>Aceasta <\/span>contribuie <\/span>la <\/span>\u00een\u021bel<\/span>egerea <\/span>locului <\/span>\u0219i <\/span>modului <\/span>\u00een <\/span>care <\/span>datele <\/span>sunt <\/span>stocate \u0219i prelucrate, \u00een special \u00een\nsistemele distribuite sau OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea \u0219i analiza continu\u0103 a datelor ad<\/span>-hoc<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>procese\n<\/span>pentru <\/span>identificarea <\/span>noilor <\/span>instan\u021be <\/span>de <\/span>date <\/span>sensibile\n<\/span>care <\/span>nu <\/span>s<\/span>unt capturate <\/span>de <\/span>inventarele <\/span>ini\u021biale. Aceasta <\/span>contribuie <\/span>la <\/span>remedierea <\/span>lacunelor <\/span>\u00een <\/span>identificarea fluxului de date \u0219i sprijin\u0103\nprotec\u021bia continu\u0103 a datelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considerare<\/span>a\nutiliz\u0103rii <\/span>T<\/span>raf<\/span>fic Light Protocol\n(T<\/span>LP)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>TLP <\/span>ar <\/span>trebui\n<\/span>luat <\/span>\u00een <\/span>considerare <\/span>ca <\/span>metod\u0103 <\/span>d<\/span>e <\/span>clasificare <\/span>\u0219i <\/span>partajare <\/span>a <\/span>datelor <\/span>legate\n<\/span>de securitatea cibernetic\u0103, \u00een special \u00een contextul r\u0103spunsului la\nincidente \u0219i al informa\u021biilor privind <\/span>amenin\u021b\u0103rile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Sistemele, <\/span>hardware<\/span>-ul, <\/span>software-ul, <\/span>serviciile <\/span>\u0219i <\/span>datele\n<\/span>sunt <\/span>gestionate <\/span>pe <\/span>tot <\/span>parcursul <\/span>ciclului <\/span>lor <\/span>de via\u021b\u0103.<\/span><\/p>\n\n

ID.AM-08.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Patch-urile <\/span>\u0219i <\/span>actualiz\u0103rile <\/span>de <\/span>securitate <\/span>pentru\n<\/span>sistemele <\/span>de <\/span>operare\n<\/span>\u0219i <\/span>componentele <\/span>critice\n<\/span>ale sistemului trebuie instalate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control\neste de a asigura <\/span>c\u0103 sistemele de\noperare \u0219i componentele critice ale sistemelor sunt <\/span>p\u0103strate <\/span>\u00een <\/span>mod <\/span>securizat <\/span>\u0219i <\/span>actualizate <\/span>prin <\/span>instalarea <\/span>de <\/span>patc<\/span>h<\/span>-uri <\/span>\u0219i <\/span>actualiz\u0103ri <\/span>de securitate \u00een timp util <\/span>\u0219i \u00een mod controlat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv<\/span>, ar trebui luat<\/span>e \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualizarea \u00een timp util<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Patch-urile <\/span>\u0219i <\/span>actualiz\u0103rile <\/span>de <\/span>securitate <\/span>ar <\/span>trebui <\/span>instalate\n<\/span>c\u00e2t <\/span>mai <\/span>cur\u00e2n<\/span>d <\/span>posibil,\n<\/span>\u00een <\/span>special pentru sistemele\ncritice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sisteme industriale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualiz\u0103rile <\/span>firmware <\/span>pentru <\/span>activele <\/span>industriale <\/span>(de <\/span>exemplu, <\/span>controler\n<\/span>logic <\/span>programabil <\/span>– PLC, interfa\u021b\u0103 om-ma\u0219in\u0103 – HMI) ar\ntrebui incluse \u00een procesul de aplicare a patch<\/span>-urilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Managemen<\/span>t\ncentralizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>u<\/span>tilizat <\/span>un <\/span>sistem <\/span>centralizat <\/span>de <\/span>management <\/span>al <\/span>patch-urilor <\/span>pen<\/span>tru <\/span>automatizarea <\/span>\u0219i eficientizarea punerii \u00een func\u021biune a acestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estare \u00eenainte de punerea \u00een func\u021biune<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Patch-urile\nar trebui testate \u00eentr<\/span>-un mediu\ncontrolat pentru evitarea \u00eentreruperilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un\nmediu de testare ar trebui s\u0103 reflecte c\u00e2t mai fidel configura\u021bia de produc\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implement\u0103ri etapizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acolo <\/span>unde <\/span>este <\/span>cazul, <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>grupuri <\/span>de <\/span>testare, <\/span>utilizatori <\/span>pilot <\/span>\u0219i <\/span>implement\u0103ri etapizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui\n<\/span>s\u0103 <\/span>existe <\/span>o <\/span>procedur\u0103 <\/span>de <\/span>revenire <\/span>la <\/span>starea <\/span>anterioar\u0103, <\/span>\u00een <\/span>cazul <\/span>\u00een <\/span>care <\/span>apar <\/span>probleme.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Numai surse <\/span>de\n\u00eencredere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Patch-urile\nar trebui desc\u0103rcate numai din surse verificate \u0219i de \u00eencredere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Link-urile\ndin e-mail-uri sau reclame ar trebui evitate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Amprent\u0103 software minim\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>instalate\n<\/span>numai <\/span>aplica\u021biile <\/span>esen\u021biale.\n<\/span>Acestora <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>le <\/span>fie <\/span>aplicate <\/span>patc<\/span>h-uri <\/span>\u0219i\ns\u0103 fie actualizate periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Practici sigure de actualizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualiz\u0103rile <\/span>automate <\/span>ar <\/span>trebui <\/span>activate\n<\/span>atunci <\/span>c\u00e2nd <\/span>dispozitivul <\/span>este <\/span>conectat <\/span>la <\/span>re\u021bele <\/span>de \u00eencredere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualiz\u0103rile\nnu ar trebui efectuate prin re\u021bele nesigure (de exemplu, <\/span>W<\/span>i<\/span>-Fi public).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Numai soft<\/span>ware\nsus\u021binut de furnizor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui utilizate numai versiuni de software sus\u021binute de <\/span>v\u00e2nz\u0103tori \u0219i actualizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software-ul\naflat la EOL <\/span>ar trebui sc<\/span>os din uz c\u00e2t mai cur\u00e2nd posibil.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea <\/span>periodic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dac\u0103 <\/span>nu <\/span>sunt <\/span>posibile <\/span>actualiz\u0103rile <\/span>automate, <\/span>ar <\/span>trebui <\/span>stabilit <\/span>un <\/span>program <\/span>periodic\n<\/span>(de exemplu, lunar) pentru verificarea manual\u0103 \u0219i instalarea\nactualiz\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instrumente de monitoriz<\/span>are a actualiz\u0103rilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>care <\/span>notific\u0103 <\/span>actualiz\u0103rile <\/span>disponibile <\/span>ar <\/span>trebui <\/span>configu<\/span>rate <\/span>pentru <\/span>a <\/span>monitoriza toate aplica\u021biile instalate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>asigure\n<\/span>r\u0103spunderea <\/span>pentru <\/span>toate\n<\/span>activele <\/span>sale <\/span>critice\n<\/span>pentru <\/span>activitate <\/span>pe parcursul ciclului de via\u021b\u0103 al\nsistemului<\/span>, inclusiv eliminarea,\ntransferurile \u0219i <\/span>casarea.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>r\u0103spunderea <\/span>pentru <\/span>toate <\/span>activele <\/span>critice\n<\/span>pentru <\/span>activitate pe <\/span>parcursul\n<\/span>\u00eentregului lor <\/span>ciclu <\/span>de <\/span>via\u021b\u0103, <\/span>inclusiv\n<\/span>punerea <\/span>\u00een <\/span>func\u021biune, mutarea <\/span>\u0219i <\/span>casarea, <\/span>pentru <\/span>a\nreduce <\/span>riscul <\/span>de <\/span>acces <\/span>neautorizat, <\/span>scurgere <\/span>de <\/span>date <\/span>sau <\/span>perturbare <\/span>opera\u021bional\u0103 <\/span>\u00een <\/span>mediile\n<\/span>TIC <\/span>\u0219i <\/span>OT. \u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een\nconsiderare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Securizarea activelor \u00eenainte de <\/span>punerea \u00een func\u021bi<\/span>une<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele,  <\/span><\/span>hardware-ul,  <\/span><\/span>software<\/span>-ul  <\/span><\/span>\u0219i  <\/span><\/span>serviciile  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>configurate\n <\/span><\/span>\u0219i\n <\/span><\/span>securizate\ncorespunz\u0103tor \u00eenainte de introducerea \u00een mediile de produc\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea \u0219i eliminarea activelor redundante<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele, <\/span>software-ul <\/span>\u0219i <\/span>serviciile <\/span>redundante\n<\/span>sau <\/span>neutilizate <\/span>care <\/span>spore<\/span>sc <\/span>suprafa\u021ba <\/span>de <\/span>atac\nar trebui identificate \u0219i eliminate periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i documentarea dinamicii activelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dinamica <\/span>activelor <\/span>critice\n<\/span>pentru <\/span>activitate <\/span>ar <\/span>trebui <\/span>urm\u0103rite,\n<\/span>iar <\/span>documenta\u021bia <\/span>ar <\/span>trebui\nmen\u021binut\u0103 pentru asigurarea trasabilit\u0103\u021bii \u0219i r\u0103spunderii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Autorizarea transferu<\/span>rilor\nde active<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Activele <\/span>critice <\/span>pentru <\/span>activitate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>poat\u0103 <\/span>intra <\/span>sau <\/span>ie\u0219i <\/span>din <\/span>incinte\n<\/span>numai <\/span>cu autoriza\u021bia\ncorespunz\u0103toare, \u00een special \u00een mediile OT<\/span>,\nunde controlul fizic al activelor este critic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Casarea activelor \u00een mod securizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Casarea <\/span>activelor <\/span>critice\n<\/span>pentru <\/span>activitate <\/span>ar <\/span>trebui <\/span>efectuat\u0103\n<\/span>\u00een <\/span>mod <\/span>securizat, <\/span>respon<\/span>sabil <\/span>\u0219i\nauditabil, pentru a preveni scur<\/span>gerea\nde date sau reutilizarea neautorizat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualizarea prompt\u0103 a inventarelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Inventarele <\/span>activelor <\/span>ar <\/span>trebui <\/span>actualizat<\/span>e <\/span>ori <\/span>de <\/span>c\u00e2t<\/span>e <\/span>ori <\/span>sistemele, <\/span>hardw<\/span>are<\/span>-ul, <\/span>software-ul\nsau serviciile sunt mutate, transferate, eliminate, scoase din uz sau\ndezafectate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>asigure\n<\/span>luarea <\/span>m\u0103surilor <\/span>necesare\n<\/span>pentru <\/span>a <\/span>gestiona\n<\/span>pierderea, <\/span>utilizarea\nnecorespunz\u0103toare, <\/span>deteriorarea <\/span>sau <\/span>furtul <\/span>activelor.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura luarea m\u0103surilor adecvate pentru prevenirea \u0219i\nr\u0103spunsul la pierderea, utilizarea necorespunz\u0103toare, deteriorarea sau furtul\nde active, <\/span>\u00een vederea protej\u0103rii\nopera\u021biunilo<\/span>r organiza\u021biei \u0219i\nreducerii riscurilor de securitate \u00een mediile TIC \u0219i OT.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea m\u0103surilor de securitate fizic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>securizarea <\/span>incintelor\n<\/span>\u0219i <\/span>a <\/span>activelor <\/span>critice, <\/span>inclusiv <\/span>a <\/span>celor <\/span>din <\/span>mediile <\/span>OT<\/span>, <\/span>ar <\/span>trebui utilizate m\u0103suri de protec\u021bie fizic\u0103,\nprecum \u00eencuietori, camere de supraveghere \u0219i alarme.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea m\u0103surilor tehnice de protec\u021bie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>protejarea <\/span>datelor <\/span>\u0219i s<\/span>istemelor\n<\/span>\u00eempotriva <\/span>accesului <\/span>neautorizat <\/span>sau <\/span>pierderii, <\/span>ar <\/span>trebui\naplicate controale tehnice, precum criptarea, \u0219ter<\/span>gerea securizat\u0103 a datelor \u0219i efectuarea periodic\u0103 a\nbackup-urilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea controalelor or<\/span>ganiza\u021bionale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span> <\/span><\/span>trebui  <\/span> <\/span><\/span>s\u0103 \n<\/span> <\/span><\/span>existe \n<\/span> <\/span><\/span>politici,  <\/span> <\/span><\/span>proceduri  <\/span> <\/span><\/span>\u0219i \n<\/span> <\/span><\/span>acorduri  <\/span> <\/span><\/span>cu \n<\/span> <\/span><\/span>utilizatorii  <\/span> <\/span><\/span>pentru \n<\/span> <\/span><\/span>definirea responsabilit\u0103\u021bilor \u0219i\na\u0219tept\u0103rilor<\/span>. Pentru gestionarea\nutiliz\u0103rii activelor ar trebui utilizate instrumente de management al\ndispozitivelor mobile (MDM) \u0219i alte instrumente administrative.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Efectuarea de audituri periodice \u0219i verific\u0103ri ale\ninventarului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>efectuate\n<\/span>audituri <\/span>periodice <\/span>\u0219i <\/span>inventarieri <\/span>ale <\/span>activelor <\/span>pentru <\/span>a <\/span>verifica <\/span>dac\u0103 <\/span>toate activele sunt eviden\u021biate \u0219i\ngestionate \u00een mod corespunz\u0103tor<\/span>.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Restric\u021biona<\/span>rea\naccesului la activele sensib<\/span>ile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>la <\/span>sisteme, <\/span>date <\/span>\u0219i <\/span>zone <\/span>fizice <\/span>critice <\/span>ar <\/span>trebui <\/span>limitat <\/span>doar <\/span>la <\/span>personalul <\/span>autorizat,\n<\/span>\u00een special \u00een medii \u00een care continuitatea opera\u021bional\u0103 este esen\u021bial\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Furnizarea de con\u0219tientizare \u0219i instruire angaja\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Personalul <\/span>ar <\/span>trebui\n<\/span>instruit <\/span>c<\/span>u <\/span>privire <\/span>la <\/span>practicile <\/span>de <\/span>protec\u021bie <\/span>a <\/span>activelor <\/span>\u0219i <\/span>\u00eencurajat <\/span>s\u0103 raporteze activit\u0103\u021bi suspecte sau in<\/span>cidente care implic\u0103 utilizarea\nnecorespunz\u0103toare sau pierderea activelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unei acoperiri adecvate de asigurare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>poli\u021be <\/span>de <\/span>as<\/span>igurare <\/span>pentru <\/span>a <\/span>contribui\n<\/span>la <\/span>atenuarea <\/span>pierderilor <\/span>fin<\/span>anciare rezultate\ndin furtul, deteriorarea sau alte incidente care afecteaz\u0103 activele.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>se <\/span>asigure <\/span>c\u0103 <\/span>ac\u021biunile <\/span>de <\/span>casare <\/span>sunt <\/span>aprobate, <\/span>urm<\/span>\u0103rite, <\/span>documentate <\/span>\u0219i verificate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Con<\/span>trol este de a asigura c\u0103 toate ac\u021biunile\nde casare care implic\u0103 sisteme informatice, date sau active fi<\/span>zice sunt autoriza<\/span>te corespunz\u0103tor, trasabile \u0219i verificabile, pentru a reduce\nriscurile, a <\/span>men\u021bine c<\/span>onformitatea \u0219i a proteja informa\u021biile\nsensibile, \u00een special \u00een mediile OT. \u00cen vederea realiz\u0103rii acestui obiectiv, ar\ntrebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aprobarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ac\u021biunile <\/span>de <\/span>casare <\/span>ar <\/span>tr<\/span>ebui <\/span>revizuite <\/span>\u0219i <\/span>aprobate <\/span>de <\/span>personalul <\/span>autorizat\n<\/span>\u00eenainte <\/span>de <\/span>execu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceasta\nasigur\u0103 alinierea cu politicile interne \u0219i c<\/span>u\nreglement\u0103rile externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Urm\u0103rirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare <\/span>ac\u021biune <\/span>de <\/span>casare <\/span>ar <\/span>trebui <\/span>jurnalizat\u0103 <\/span>cu <\/span>detalii <\/span>cheie,\n<\/span>inclusiv <\/span>tipul <\/span>activului <\/span>sau mediului, metoda de casare, data \u0219i persoanele impli<\/span>cate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>etapele, <\/span>de <\/span>la <\/span>aprobare <\/span>p\u00e2n\u0103 <\/span>la <\/span>verificare, <\/span>ar <\/span>trebui <\/span>documentate <\/span>\u00een <\/span>mod <\/span>clar<\/span>. <\/span>Aceasta include \u00eenregistr\u0103rile de\naprobare, jurnalele de urm\u0103rire \u0219i orice dovezi justificative.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Casarea <\/span>ar <\/span>trebui\n<\/span>verificat\u0103 <\/span>pentru <\/span>a <\/span>confi<\/span>rma <\/span>efectuarea <\/span>corect\u0103.\n<\/span>Aceasta <\/span>poate <\/span>implica verificarea faptului c\u0103 datele au\nfost \u0219terse \u00een mod securizat sau c\u0103 distrugerea fizic\u0103 a fost efectiv\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceast\u0103 <\/span>abordare <\/span>structurat\u0103 <\/span>contribuie <\/span>la <\/span>men\u021binerea <\/span>r\u0103spunderii <\/span>\u0219i <\/span>a <\/span>securit\u0103\u021bii, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>mediil<\/span>e<\/span><\/p>\n\n

 <\/span><\/p>\n\n

OT, <\/span>unde <\/span>casarea\n<\/span>necorespunz\u0103toare <\/span>poate <\/span>duce <\/span>la <\/span>perturb\u0103ri <\/span>opera\u021bionale <\/span>sau <\/span>la <\/span>riscuri <\/span>de <\/span>siguran\u021b\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.6<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>planifice,\n<\/span>s\u0103 <\/span>efectueze <\/span>\u0219i <\/span>s\u0103 <\/span>documenteze <\/span>mentenan\u021ba <\/span>preventiv\u0103 <\/span>\u0219i <\/span>repara\u021biile\ncomponentelor critice ale sistemului s\u0103u, \u00een conformitate cu proc<\/span>esele \u0219i instrumentele aprobate. GHID DE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\nc\u0103 <\/span>mentenan\u021ba <\/span>preventiv\u0103 <\/span>\u0219i <\/span>repara\u021biile <\/span>componentelor critice <\/span>ale <\/span>sistemului <\/span>sunt <\/span>planificate, <\/span>efectuate <\/span>\u0219i <\/span>documentat<\/span>e <\/span>\u00eentr-un <\/span>mod <\/span>sigur <\/span>\u0219i <\/span>consecvent, <\/span>pentru men\u021binerea fiabilit\u0103\u021bii sistemului\n\u0219i reducerea riscurilor opera\u021bionale \u00een mediile TIC \u0219i OT.<\/span><\/p>\n\n

\u00cen vederea\nrealiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea procedurilor de mentena<\/span>n\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politicile <\/span>\u0219i <\/span>procedurile <\/span>de <\/span>mentenan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>clar <\/span>definite <\/span>\u0219i <\/span>incluse <\/span>\u00een <\/span>planurile <\/span>de securitate cibernetic\u0103 \u0219i opera\u021bionale\nale or<\/span>ganiza\u021biei. Supravegherea\nacestor proceduri ar trebui s\u0103 fac<\/span>\u0103\nparte din responsabilit\u0103\u021bile conducerii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Autori<\/span>zarea\npersonalului de mentenan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>stabilit <\/span>un <\/span>proces <\/span>de <\/span>autorizare\n<\/span>a <\/span>pers<\/span>oanelor <\/span>fizice <\/span>sau <\/span>a <\/span>furnizorilor <\/span>externi <\/span>care efectueaz\u0103 <\/span>opera\u021biuni <\/span>de <\/span>mentenan\u021b\u0103. Ar <\/span>trebui <\/span>men\u021binut\u0103 <\/span>\u0219i <\/span>revizuit\u0103 <\/span>periodic\n<\/span>o <\/span>list\u0103 <\/span>a personalului sau a or<\/span>ganiza\u021biilor\naprobate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Programarea \u0219i \u00eenregistrarea activit\u0103\u021bilor de\nmentenan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mentenan\u021ba  <\/span><\/span>preventiv\u0103  <\/span><\/span>\u0219i  <\/span><\/span>repara\u021biile  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>programate,\n <\/span><\/span>efectuate\n <\/span><\/span>\u0219i\n <\/span><\/span>documentate\n <\/span><\/span>\u00een\nconformitate <\/span>cu <\/span>cerin\u021bele <\/span>or<\/span>ganiza\u021bionale <\/span>\u0219i <\/span>specifica\u021biile <\/span>v\u00e2nz\u0103torului. <\/span>\u00cenregistr\u0103rile <\/span>ar <\/span>trebui revizuite pe<\/span>ntru a asigura completitudinea \u0219i acurate\u021bea acestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea tuturor activit\u0103\u021bilor de mentenan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>lucr\u0103rile <\/span>de <\/span>mentenan\u021b\u0103, <\/span>indiferent\n<\/span>da<\/span>c\u0103 <\/span>sunt <\/span>efectuate <\/span>la <\/span>fa\u021ba <\/span>locului <\/span>sau <\/span>la <\/span>distan\u021b\u0103, <\/span>ar trebui\n<\/span>aprobate <\/span>\u00een <\/span>prealabil\n<\/span>\u0219i <\/span>monitorizate <\/span>\u00een <\/span>ti<\/span>mpul <\/span>execut<\/span>\u0103rii. <\/span>Aceasta <\/span>include <\/span>\u00eentre\u021binerea\ncomponentelor scoase din incint\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea unei mentenan\u021be sigure \u0219i fiabile a\nechipamentelor OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mentenan\u021ba <\/span>sistemelor <\/span>OT <\/span>ar <\/span>trebui <\/span>planificat\u0103 <\/span>\u0219i <\/span>efectuat\u0103 <\/span>\u00eentr<\/span>-un <\/span>mod <\/span>care <\/span>s\u0103 <\/span>asigure\nsiguran\u021ba <\/span>opera\u021biunilor<\/span>, <\/span>s\u0103 <\/span>evite\n<\/span>perioadele <\/span>de <\/span>nefunc\u021bionare <\/span>in<\/span>utile <\/span>\u0219i <\/span>s\u0103 <\/span>respecte\n<\/span>instruc\u021biunile sau cerin\u021bele specifice ale v\u00e2nz\u0103torilor de echipamente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.7<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie <\/span>s\u0103 \u00eempiedice \u00eendep\u0103rtarea neautorizat\u0103 a\nechipamentelor <\/span>de mentenan\u021b\u0103 <\/span>care con\u021bin informa\u021bii critice despre\nsistemul organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>preveni <\/span>\u00eendep\u0103rtarea <\/span>neautori<\/span>zat\u0103 <\/span>a <\/span>echipamentelor\nde mentenan\u021b\u0103 care <\/span>pot <\/span>con\u021bine <\/span>informa<\/span>\u021bii <\/span>critice <\/span>despre <\/span>sistem,\nreduc\u00e2nd <\/span>riscul <\/span>de <\/span>scurgere <\/span>sau <\/span>f<\/span>urt <\/span>de\ndate, \u00een special \u00een mediil<\/span>e OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Echipamentele <\/span>de <\/span>mentenan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>verificate <\/span>pentru <\/span>a <\/span>confirma\n<\/span>c\u0103 <\/span>nu <\/span>con\u021bin <\/span>informa\u021bii ale\nor<\/span>ganiza\u021biei \u00eenainte de a fi\n\u00eendep\u0103rtate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sanitizarea sau distrugerea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dac\u0103 <\/span>sunt <\/span>prezente\n<\/span>date <\/span>sensibile, <\/span>echipamentul <\/span>ar <\/span>trebui <\/span>sanitizat <\/span>sau <\/span>distrus <\/span>\u00een <\/span>mod <\/span>securizat, conform procedurilor aprobate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>P\u0103strarea <\/span>\u00een <\/span>incint\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Echipamentul <\/span>ar <\/span>trebui\ns<\/span>\u0103 <\/span>r\u0103m\u00e2n\u0103 <\/span>\u00een <\/span>incint\u0103, <\/span>cu <\/span>excep\u021bia <\/span>cazului\n<\/span>\u00een <\/span>care <\/span>\u00eendep\u0103rtarea <\/span>acestuia este strict necesar\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ob\u021binerea u<\/span>nei\nderog\u0103ri<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dac\u0103  <\/span><\/span>este  <\/span><\/span>necesar\u0103  <\/span><\/span>\u00eendep\u0103rtarea,  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>ob\u021binut\u0103\n <\/span><\/span>autorizarea\n <\/span><\/span>explicit\u0103\n <\/span><\/span>din\n <\/span><\/span>partea\npersonalului sau a persoanelor desemnate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen acest context,\nechipamentele de m<\/span>entenan\u021b\u0103 se refer\u0103\nla hardware-ul utilizat temporar pentru service sau diagnosticare, precum\nunit\u0103\u021bi externe, <\/span>servere temporare\nsau instrumente OT\/ICS specializate \u0219i nu la instrumentele de mentenan\u021b\u0103\nobi\u0219nuite acoper<\/span>ite de C<\/span>ontrolul ID.<\/span>AM<\/span>-08.9.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.8<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia  <\/span><\/span>trebuie  <\/span><\/span>s\u0103  <\/span><\/span>aprobe\n <\/span><\/span>\u00een\n <\/span><\/span>preala<\/span>bil,  <\/span><\/span>s\u0103  <\/span><\/span>monitorizeze  <\/span><\/span>\u0219i  <\/span><\/span>s\u0103  <\/span><\/span>pun\u0103  <\/span><\/span>\u00een  <\/span><\/span>aplicare\n <\/span><\/span>utilizarea\ninstrumentelor de mentenan\u021b\u0103 pentru sistemele sale critice.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 instrumentele de mentenan\u021b\u0103 u<\/span>tilizate pe sistemele critice <\/span>sunt aprobate <\/span>\u00een <\/span>prealabil, <\/span>monitorizate <\/span>\u0219i <\/span>puse <\/span>\u00een <\/span>aplicare <\/span>pentru <\/span>protejarea <\/span>integrit\u0103\u021bii, siguran\u021bei \u0219i continuit\u0103\u021bii\nopera\u021bionale a sistemului. \u00cen mediile OT, utilizarea necorespunz\u0103toare a\ninstrumentelor poate interfera c<\/span>u\nprocesele fizice, ceea ce face ca controlul asupra aprob\u0103rii \u0219i utiliz\u0103rii\ninstrumentelor s\u0103 fie esen\u021bial pentru siguran\u021ba \u0219i fiabilitatea opera\u021bional\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea sis<\/span>temelor\ncritice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>care <\/span>au <\/span>impact <\/span>asupra <\/span>siguran\u021bei, <\/span>calit\u0103\u021bii, <\/span>conformit\u0103\u021bii <\/span>cu <\/span>reglement\u0103rile <\/span>sau randamentului <\/span>opera\u021bional <\/span>ar <\/span>trebui <\/span>clasificate <\/span>ca <\/span>fiind <\/span>critice.\n<\/span>Indicatori <\/span>precum <\/span>timpul <\/span>mediu\nde reparare (MTTR) \u0219i timpul mediu \u00eentre defe<\/span>c\u021biuni <\/span>(MTBF) ar trebu<\/span>i s\u0103 sprijine aceast\u0103 clasificare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instrumente <\/span>aprobate <\/span>\u00een <\/span>prealabil<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Numai <\/span>instrumentele <\/span>de <\/span>mentenan\u021b\u0103 <\/span>care <\/span>au <\/span>fost <\/span>revizuite <\/span>\u0219i <\/span>aprobate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>permise pentru <\/span>utilizare <\/span>pe <\/span>sisteme\nc<\/span>r<\/span>itice. <\/span>Aceasta <\/span>include <\/span>at\u00e2t <\/span>instrumente <\/span>ha<\/span>rdware<\/span>, <\/span>c\u00e2t <\/span>\u0219i <\/span>software,\nprecum dispozitive de diagnosticare, snif<\/span>fere\nde pachete \u0219i laptopuri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea utiliz\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>instrumentelor <\/span>de <\/span>mentenan\u021b\u0103 <\/span>pe <\/span>sistemele <\/span>critice\n<\/span>ar <\/span>trebui <\/span>monitorizat\u0103 <\/span>activ pentru detec\u021bia activit\u0103\u021bilor neautorizate sau nesi<\/span>gure.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na controalelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>politici\n<\/span>\u0219i <\/span>controale <\/span>tehnice\n<\/span>pentru <\/span>prevenirea <\/span>utiliz<\/span>\u0103rii <\/span>instrumentelor neaprobate \u0219i pentru\nasigurarea conformit\u0103\u021bii cu procedurile interne \u0219i respectarea legilor \u0219i\nreglement\u0103rilor aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.9<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Instrumentele <\/span>de <\/span>mentenan\u021b\u0103 <\/span>\u0219i <\/span>dispozitivele <\/span>de <\/span>stocare <\/span>portabile\n<\/span>trebuie <\/span>inspectate <\/span>la <\/span>intrarea\n\u00een incint\u0103 <\/span>\u0219i <\/span>protejate <\/span>cu <\/span>solu\u021bii\n<\/span>antimalware <\/span>care le <\/span>scaneaz\u0103\n<\/span>\u00een <\/span>c\u0103utarea <\/span>codurilor\n<\/span>cu <\/span>scop <\/span>nelegitim \u00eenainte de a f<\/span>i\nutilizate \u00een sistemele organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a preveni introducerea de cod cu scop nelegitim \u00een sistemele\norganiza\u021biei, prin asigurarea faptului <\/span>c\u0103\ntoate instrumentele de ment<\/span>enan\u021b\u0103 \u0219i\ndispozitivele de stoc<\/span>are portabile <\/span>sunt <\/span>inspectate <\/span>\u0219i <\/span>scanate <\/span>\u00eenainte\n<\/span>de <\/span>utiliz<\/span>are. <\/span>\u00cen <\/span>mediile\n<\/span>OT, <\/span>introducerea de <\/span>instrumente sau dispozitive de stocare\nneverificate poate compromite integritatea sistemului \u0219i perturba opera\u021biunile <\/span>fizice\n<\/span>critice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestu<\/span>i obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Inspectarea la intrare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>de <\/span>mentenan\u021b\u0103 <\/span>\u0219i <\/span>dispozitivele <\/span>de <\/span>stocare <\/span>portabile <\/span>ar <\/span>trebui <\/span>inspectate <\/span>la intrarea \u00een incint\u0103, pentru detec\u021bia elementelor\nneautorizate sau suspecte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Scanarea <\/span>malware<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>dispozitivele <\/span>ar <\/span>trebui <\/span>scanate\n<\/span>folosind <\/span>solu\u021bii <\/span>antimalware <\/span>actualizate <\/span>\u00eenainte <\/span>de <\/span>a <\/span>fi conectate la sistemele or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea asupra tuturor tipurilor de instrumente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceasta <\/span>include <\/span>instrumente <\/span>software <\/span>(de <\/span>exemplu, <\/span>software <\/span>de <\/span>diagnosticare, <\/span>actualiz\u0103ri <\/span>d<\/span>e firmware, <\/span>instrumente <\/span>de <\/span>configurare, <\/span>instrumente <\/span>de <\/span>acces <\/span>la <\/span>dist<\/span>an\u021b\u0103), <\/span>dispozitive <\/span>de <\/span>stocare\nportabile (de exemplu, dispozitive USB, hard\n<\/span>disk<\/span>-uri externe, carduri SD)\n\u0219i instrumente hardware (de exemplu, laptopuri, tablete<\/span>, dispozitive portabile de diagnosticare).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea tehnicilor de sanitizare ne<\/span>distructive<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Atunci <\/span>c\u00e2nd <\/span>dispozitivele <\/span>sunt <\/span>nou <\/span>achizi\u021bionate <\/span>sau <\/span>nu <\/span>au <\/span>un <\/span>lan\u021b <\/span>de <\/span>custodie <\/span>de <\/span>\u00eencredere, \u00eenainte de prima utilizare ar\ntrebui aplicate tehnici de sanitizare ne<\/span>distructive.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>ac\u021biunile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>conforme\n<\/span>cu <\/span>procedurile <\/span>interne\n<\/span>\u0219i <\/span>s\u0103 <\/span>respecte <\/span>regleme<\/span>nt\u0103rile aplicabile \u00een materie de\nsecuritate cibernetic\u0103 \u0219i standardele din domeniu.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.10<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>verifice\n<\/span>controalele <\/span>de <\/span>securitate <\/span>dup<\/span>\u0103 <\/span>mentenan\u021b\u0103 <\/span>sau <\/span>repara\u021bii\/aplicare <\/span>de patch-uri \u0219i s\u0103 ia m\u0103suri\ncorespunz\u0103toare.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>co<\/span>ntroalele <\/span>de <\/span>securitate <\/span>r\u0103m\u00e2n <\/span>eficace <\/span>dup\u0103 <\/span>activit\u0103<\/span>\u021bile de mentenan\u021b\u0103, repara\u021bii sau aplicare\nde patch<\/span>-uri. \u00cen mediile OT, chiar \u0219i\nmodific\u0103rile minore de configurare pot avea consecin\u021be <\/span>semnificative asupra siguran\u021bei sau a opera\u021biunilor, ceea ce fac<\/span>e ca verificarea dup\u0103 mentenan\u021b\u0103 s\u0103 fie\ncritic\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea controalelor de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dup\u0103 <\/span>mentenan\u021b\u0103, <\/span>sistemele\n<\/span>ar <\/span>trebui <\/span>evaluate\n<\/span>pentru <\/span>a <\/span>confirma\n<\/span>c\u0103 <\/span>nicio <\/span>modificare <\/span>nu <\/span>a sl\u0103bit <\/span>securitatea. <\/span>Aceasta <\/span>include <\/span>verificarea <\/span>configura\u021biilor<\/span>, <\/span>a <\/span>permisiunilor <\/span>de <\/span>acces <\/span>\u0219i <\/span>a <\/span>altor set\u0103ri relevante pentru securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualizarea \u00eenregistr\u0103rilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Orice <\/span>modific\u0103ri <\/span>efectuate <\/span>\u00een <\/span>timpul <\/span>mentenan\u021bei <\/span>ar <\/span>trebui <\/span>documentate, <\/span>inclusiv <\/span>actualiz\u0103rile\ncontroalelor de securitate sau im<\/span>plementarea\nde noi m\u0103suri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Raportarea <\/span>problemelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dac\u0103 <\/span>\u00een <\/span>timpul\n<\/span>verific\u0103rii <\/span>sunt <\/span>identificate <\/span>probleme <\/span>de <\/span>securitate, <\/span>constat\u0103rile <\/span>ar <\/span>trebui comunicate p\u0103r\u021bilor interesate\nrelevante, pentru asigurare<\/span>a\ncon\u0219tientiz\u0103rii \u0219i coordon\u0103rii r\u0103spunsului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Luarea m\u0103surilor corective<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dac\u0103 <\/span>se <\/span>constat\u0103\n<\/span>c\u0103 <\/span>m\u0103surile <\/span>de <\/span>control <\/span>sunt <\/span>inadecvate <\/span>sau <\/span>compromise, <\/span>ar <\/span>trebui <\/span>luate\n<\/span>m\u0103suri corective. Acestea <\/span>ar <\/span>putea\n<\/span>include <\/span>recon<\/span>figurarea\n<\/span>set\u0103rilor<\/span>, <\/span>aplicarea <\/span>de <\/span>patch<\/span>-uri suplimentare sau consolidarea\ncontroalelor existente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>ac\u021biunile <\/span>de <\/span>verificare <\/span>\u0219i <\/span>m\u0103surile <\/span>corective <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>conforme\n<\/span>cu <\/span>procedurile interne \u0219i s\u0103\nrespecte legile, reglement\u0103rile \u0219i standardele din domeniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.11<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile <\/span>de <\/span>men<\/span>tenan<\/span>\u021b\u0103 <\/span>\u0219i <\/span>diagnosticare <\/span>la <\/span>distan\u021b\u0103 <\/span>ale <\/span>activelor <\/span>organiza\u021biei <\/span>trebuie <\/span>s\u0103 <\/span>fie <\/span>aprobate\n\u00een prealabil, iar realizarea acestora trebuie jurnali<\/span>zat\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a asigura c\u0103 <\/span>activit\u0103\u021bile <\/span>de <\/span>mentenan\u021b\u0103\n<\/span>\u0219i <\/span>diagnostic<\/span>are <\/span>la <\/span>distan\u021b\u0103 sunt  <\/span>autorizate, \n<\/span>trasabile <\/span>\u0219i  <\/span>sigure. \n<\/span>\u00cen  <\/span>mediile  <\/span>OT, \n<\/span>mentenan\u021ba  <\/span>la  <\/span>distan\u021b\u0103 \n<\/span>trebuie  <\/span>s\u0103  <\/span>fie \n<\/span>strict controlat\u0103, deoarece <\/span>modific\u0103rile <\/span>neautorizate <\/span>pot <\/span>afecta <\/span>\u00een <\/span>mod <\/span>direct <\/span>siguran\u021ba <\/span>\u0219i <\/span>stabilitatea\nsistemelor fi<\/span>zice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aprobarea prealabil\u0103 a activit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>activit\u0103\u021bile <\/span>de <\/span>mentenan\u021b\u0103 <\/span>\u0219i <\/span>diagnosticare <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>\u0219i <\/span>aprobate \u00eenainte de\nexecutare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Jurnalizarea <\/span>performan\u021bei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare <\/span>sesiune <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>jurnalizat\u0103 <\/span>\u00een <\/span>detaliu, <\/span>inclusiv\n<\/span>ora, <\/span>durata, <\/span>personalul implicat \u0219i ac\u021biun<\/span>ile \u00eentre<\/span>prinse.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea procedurilor de jurnalizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile  <\/span><\/span>de  <\/span><\/span>jurnalizare  <\/span><\/span>\u0219i  <\/span><\/span>monitorizare  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>documentate,\n <\/span><\/span>aprobate,\n <\/span><\/span>comunicate,\naplicate \u0219i revizuite periodic, ideal ar fi anual.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Prevenirea modific\u0103rilor neautorizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>implementate  <\/span><\/span>m\u0103suri\n <\/span><\/span>tehnice\n <\/span><\/span>\u0219i\n <\/span><\/span>procedurale\n <\/span><\/span>pentru\n <\/span><\/span>detec\u021bia\n <\/span><\/span>sau\n <\/span><\/span>prevenirea\nmodific\u0103rilor neautorizate ale sistemelor<\/span>,\nconfigura\u021biilor<\/span>, aplica\u021biilor sau\ninfrastructurii \u00een timpul accesului la distan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate  <\/span><\/span>activit\u0103\u021bile  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>fie  <\/span><\/span>conforme\n <\/span><\/span>cu\n <\/span><\/span>politicile\n <\/span><\/span>interne\n <\/span><\/span>\u0219i\n <\/span><\/span>s\u0103\n <\/span><\/span>respecte\n <\/span><\/span>legile,\nreglement\u0103rile \u0219i standardele din domeniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.12<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Configurare<\/span>a <\/span>sesiunilor <\/span>de <\/span>mentenan\u021b\u0103 <\/span>\u0219i <\/span>diagnosticare <\/span>non-locale <\/span>prin <\/span>conexiuni <\/span>de <\/span>re\u021bea <\/span>la <\/span>distan\u021b\u0103\ntrebuie <\/span>s\u0103 <\/span>necesite <\/span>autentificatori <\/span>puternici, <\/span>iar <\/span>aceste <\/span>conexiuni\n<\/span>trebuie <\/span>\u00eentrerupte la <\/span>finalizarea mentenan\u021bei non-locale.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>sesiunile <\/span>de mentenan\u021b\u0103 \u0219i <\/span>diagnosticare <\/span>non<\/span>-locale sunt <\/span>stabilite <\/span>\u00een <\/span>mod <\/span>securizat <\/span>\u0219i <\/span>terminate <\/span>corespunz\u0103t<\/span>or, <\/span>pentru <\/span>prevenirea <\/span>accesului <\/span>neautorizat <\/span>sau conexiunilor persistente. \u00cen mediile\nOT, configurarea \u0219i te<\/span>rmin<\/span>area sec<\/span>urizat\u0103\na sesiunilor sunt esen\u021biale pentru prevenirea c\u0103ilor de acces persistente care\nar putea fi exploatate pentru perturbarea opera\u021biunilo<\/span>r fizice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea autentific\u0103rii puternice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sesiunile <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>protejate\n<\/span>prin <\/span>autentificatori <\/span>puternici\n<\/span>care <\/span>rezist\u0103 <\/span>atacurilor <\/span>prin reluare. MF<\/span>A <\/span>ar trebui utilizat\u0103 acolo unde este\nposibil.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea c<\/span>omunica\u021biilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>implementate  <\/span><\/span>mecanisme\n <\/span><\/span>criptografice\n <\/span><\/span>pentru\n <\/span><\/span>a<\/span>sigurarea  <\/span><\/span>confiden\u021bialit\u0103\u021bii  <\/span><\/span>\u0219i\nintegrit\u0103\u021bii comunica\u021biilor de mentenan\u021b\u0103 la distan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cenchiderea sesiunilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conexiunile <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>\u00eenchise\n<\/span>imediat <\/span>dup\u0103 <\/span>finalizarea <\/span>mentenan\u021bei <\/span>pentru <\/span>a <\/span>reduce\nexpunerea la poten\u021biale amenin\u021b\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea <\/span>deco<\/span>nect\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>erificarea <\/span>deconect\u0103rii <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>utilizat\u0103\n<\/span>pentru <\/span>a <\/span>confirma <\/span>c\u0103 <\/span>sesiunile\n<\/span>au <\/span>fost \u00eenchise complet \u0219i nu\nmai sunt accesibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>activit\u0103\u021bile <\/span>de <\/span>acces <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>co<\/span>nforme <\/span>cu <\/span>procedurile <\/span>interne\n<\/span>de securitate \u0219i s\u0103 respecte legile, regle<\/span>ment\u0103rile \u0219i standardele din domeniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.AM-08.13<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nsolicite ca serviciile de diagnosticare pentru mentenan\u021ba la distan\u021b\u0103 s\u0103 fi<\/span>e efectuate <\/span>de <\/span>pe <\/span>un <\/span>si<\/span>stem <\/span>care\nimplementeaz\u0103 <\/span>caracteristici <\/span>de <\/span>securitate <\/span>similare cu <\/span>cele implementate pe sistemul critic echivalent al organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura c\u0103 <\/span>serviciile <\/span>de\nmentenan\u021b\u0103 \u0219i <\/span>diagnostic<\/span>are <\/span>la <\/span>distan\u021b\u0103 sunt prestate de sisteme care\nimplementeaz\u0103 caracteristici de securitate echivalente cu cele ale sistemelor\ncritice ale organiza\u021biei. \u00cen mediile OT, acea<\/span>st\u0103\naliniere este esen\u021bial\u0103 pentru men\u021binerea unei\n<\/span>posturi de <\/span>securitate <\/span>consecvente, <\/span>pentru prevenirea <\/span>in<\/span>troducerii <\/span>vulnerabilit\u0103\u021bilor <\/span>\u0219i <\/span>pentru protejarea siguran\u021bei, fiabilit\u0103\u021bii\n\u0219i continuit\u0103\u021bii opera\u021biunilor fizice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea <\/span>autentific\u0103rii <\/span>puternice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele  <\/span><\/span>la  <\/span><\/span>distan\u021b\u0103  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>implementeze\n <\/span><\/span>MF<\/span>A <\/span>pentru\n <\/span><\/span>a\n <\/span><\/span>asigura\n <\/span><\/span>c\u0103\n <\/span><\/span>accesul\n <\/span><\/span>este\nrestric\u021bionat la personalul autorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea \u00eenregistr\u0103rilor activit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>men\u021binute  <\/span><\/span>\u0219i  <\/span><\/span>revizuite\n <\/span><\/span>periodic\n <\/span><\/span>jurnale\n <\/span><\/span>detalia<\/span>te  <\/span><\/span>ale  <\/span><\/span>tuturor  <\/span><\/span>activit\u0103\u021bilor  <\/span><\/span>de\nmentenan\u021b\u0103 la distan\u021b\u0103, p<\/span>entru\ndetec\u021bia <\/span>anomaliilor sau ac\u021biunilor\nneautorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea instrumentelor \u0219i procedurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>instrumentele <\/span>\u0219i <\/span>procedurile <\/span>utilizate\n<\/span>\u00een <\/span>timpul <\/span>mentenan\u021bei <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie\naliniate <\/span>la <\/span>politicile <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>documentate <\/span>\u00ee<\/span>n <\/span>planurile\n<\/span>relevante <\/span>de <\/span>securitate <\/span>cibernetic\u0103 sau a informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cenchiderea sesiunilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sesiunile <\/span>la <\/span>distan\u021b\u0103\n<\/span>ar <\/span>trebui <\/span>\u00eenchise\n<\/span>corespunz\u0103tor <\/span>dup\u0103 <\/span>finalizarea <\/span>mentenan\u021bei, <\/span>pentru\nprevenirea accesului prelungit.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i <\/span>respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>\u0219i <\/span>activit\u0103\u021bile <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>cerin\u021bele\n<\/span>interne <\/span>de <\/span>securitate\n<\/span>\u0219i <\/span>s\u0103 <\/span>se conformeze legilor<\/span>,\nreglement\u0103rilor \u0219i standardelor din domeniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[ID.RA] EVALUAREA RISCURI<\/span>LOR<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen\u021belegerea <\/span>riscului <\/span>de <\/span>secu<\/span>ritate <\/span>cibernetic\u0103 <\/span>pentru <\/span>organiza\u021bie, <\/span>active <\/span>\u0219i <\/span>persoane\n<\/span>fi<\/span>zice <\/span>de <\/span>c\u0103tre organiza\u021bie.<\/span><\/p>\n\n

ID.RA-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Vulnerabilit\u0103\u021bile\nactivelor sunt identificate, validate \u0219i \u00eenregistrate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Amenin\u021b\u0103rile <\/span>\u0219i <\/span>vulnerabilit\u0103\u021bile <\/span>tre<\/span>buie <\/span>identificate <\/span>\u00een <\/span>toate <\/span>activele\n<\/span>rel<\/span>evante, <\/span>inclusiv\n<\/span>software<\/span>-ul, arhitecturile de\nre\u021bea \u0219i de sistem, precum \u0219i incintele care g\u0103<\/span>zduiesc\nactive informatice critice. GHID DE\nIMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de\na <\/span>ajuta <\/span>organiza\u021biile <\/span>s\u0103 <\/span>atenueze <\/span>riscurile <\/span>de <\/span>securitate <\/span>cibernetic\u0103 prin identificarea\namenin\u021b\u0103rilor \u0219i vulnerabilit\u0103\u021bilor din activele lor critice. Acestea includ\nsoftware<\/span>– ul, re\u021belele, sistemele \u0219i\nincintele care sus\u021bin opera\u021biunile informatice esen\u021biale.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een conside<\/span>rare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cen\u021belegerea <\/span>conceptelor <\/span>cheie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>O <\/span>vulnerabilitate <\/span>este <\/span>o <\/span>sl\u0103biciune <\/span>a <\/span>hardware<\/span>-ului<\/span>, <\/span>software-ului <\/span>sau <\/span>procedurilor <\/span>care <\/span>ar\nputea fi exploatat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>O  <\/span><\/span>amenin\u021bare  <\/span><\/span>este  <\/span><\/span>un  <\/span><\/span>eveniment\n <\/span><\/span>sau\n <\/span><\/span>un\n <\/span><\/span>actor\n <\/span><\/span>care\n <\/span><\/span>poate\n <\/span><\/span>\u00eencerca\n <\/span><\/span>s\u0103\n <\/span><\/span>exploateze\n <\/span><\/span>o\nvulnerabilitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un  <\/span><\/span>risc  <\/span><\/span>este  <\/span><\/span>impactul  <\/span><\/span>posibil  <\/span><\/span>\u00een  <\/span><\/span>cazul\n <\/span><\/span>\u00een\n <\/span><\/span>care\n <\/span><\/span>o\n <\/span><\/span>amenin\u021bare\n <\/span><\/span>exploateaz\u0103\n <\/span><\/span>cu\n <\/span><\/span>succes\n <\/span><\/span>o\nvulnerabilitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea <\/span>activelor <\/span>relevante<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate sistemele,\naplica\u021biile, re\u021belele \u0219i inci<\/span>ntele\ncritice ar trebui enumerate \u0219i documentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>R\u0103spunsul la vulnerabilit\u0103\u021bi<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021biile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia <\/span>m\u0103suri <\/span>\u00een <\/span>cazul <\/span>vulnerabilit\u0103\u021bilor <\/span>raportate\n<\/span>de <\/span>surse <\/span>de <\/span>\u00eencredere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(de\nexemplu, v\u00e2nz\u0103torilor<\/span>, furnizori de\nservicii, avertiz\u0103ri guvernamentale).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>La <\/span>nivel <\/span>de <\/span>baz\u0103, <\/span>scanarea\n<\/span>activ\u0103 <\/span>nu <\/span>este <\/span>necesar\u0103, <\/span>dar <\/span>vulnerabilit\u0103\u021bile <\/span>cu<\/span>noscute <\/span>ar <\/span>trebui\nremediate prompt.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Con\u0219tientizarea amenin\u021b\u0103rilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021biile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>se <\/span>informeze\n<\/span>\u00een <\/span>permanen\u021b\u0103 <\/span>cu <\/span>privire <\/span>la <\/span>amenin\u021b\u0103rile <\/span>comune relevante pentru sectorul lor (de\nexemplu, phishing, ransomware, riscuri legate de lan\u021bul de aprovizionare).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie  <\/span><\/span>stabilit  <\/span><\/span>un  <\/span><\/span>proces\n <\/span><\/span>pentru\n <\/span><\/span>monitorizarea,\n <\/span><\/span>identificarea\n <\/span><\/span>\u0219i\n <\/span><\/span>documentarea\n <\/span><\/span>continu\u0103\n <\/span><\/span>a\nvulnerabilit\u0103\u021bilor sistemelor critice pentru activitate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nasigura <\/span>identificarea, <\/span>monitorizarea <\/span>\u0219i <\/span>documentarea <\/span>continu\u0103\n<\/span>a vulnerabilit\u0103\u021bilor <\/span>sistemelor <\/span>critice\n<\/span>pentru <\/span>activitate, <\/span>pentru\n<\/span>a <\/span>sprijini <\/span>atenu<\/span>area <\/span>riscurilor <\/span>\u00een <\/span>timp <\/span>util \u0219i men\u021binerea rezilien\u021bei opera\u021bionale<\/span>.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui l<\/span>u<\/span>ate\n\u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea scan\u0103rii vulnerabilit\u0103\u021bilor acolo unde este\nsigur<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Scanarea <\/span>vulnerabilit\u0103\u021bilor <\/span>ar <\/span>trebui <\/span>aplicat\u0103\n<\/span>sistemelor <\/span>IT <\/span>\u0219i <\/span>OT <\/span>\u00een <\/span>cazul <\/span>\u00een <\/span>care <\/span>aceasta\n<\/span>nu perturb\u0103 <\/span>opera\u021biunile <\/span>\u0219i <\/span>nu <\/span>compromite <\/span>siguran\u021ba. <\/span>\u00cen <\/span>mediile\n<\/span>OT ar <\/span>trebui <\/span>preferate\n<\/span>metodele pasive sau neintruzive.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een func\u021biune a instrumentelor de manag<\/span>ement al vulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizate\n<\/span>instrumente <\/span>pentru <\/span>detec\u021bia\n<\/span>software<\/span>-ului <\/span>neactualizat, <\/span>a <\/span>configura\u021biilo<\/span>r incorecte \u0219i a firmware-ului \u00eenvechit\nat\u00e2t \u00een cadrul activelor IT<\/span>, c\u00e2t \u0219i OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea arhitecturilor pentru identificarea\npunctelor slabe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Arhitecturile  <\/span><\/span>de  <\/span><\/span>re\u021bea  <\/span><\/span>\u0219i  <\/span><\/span>de  <\/span><\/span>sistem,  <\/span><\/span>inclusiv  <\/span><\/span>segmentarea,\n <\/span><\/span>c\u0103ile\n <\/span><\/span>de\n <\/span><\/span>acces\n <\/span><\/span>la\n <\/span><\/span>distan\u021b\u0103\n <\/span><\/span>\u0219i\ncomponentele <\/span>vechi, <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>pentru <\/span>identificarea defe<\/span>ctelor <\/span>de <\/span>proiectare <\/span>care <\/span>ar putea expune\nsistemele OT <\/span>la amenin\u021b\u0103ri\ncibernetice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea surselor de informa\u021bii privind\namenin\u021b\u0103rile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sursele <\/span>publice <\/span>\u0219i <\/span>private <\/span>de <\/span>informa\u021bii <\/span>privind\n<\/span>amenin\u021b\u0103rile <\/span>cibernetice <\/span>ar <\/span>trebui <\/span>monitorizate pentru identificarea\nvulnerabilit\u0103\u021bilor care afectea<\/span>z\u0103\nprodusele OT<\/span>, ICS \u0219i tehn<\/span>ologiile specifice v\u00e2nz\u0103torilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea software-ului dezvoltat de or<\/span>ganiza\u021bie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aplica\u021biile <\/span>personalizate, <\/span>inclusiv\n<\/span>cele <\/span>utilizate <\/span>\u00een <\/span>medii <\/span>OT <\/span>(de <\/span>exemplu,\n<\/span>HMI<\/span>-uri, <\/span>logica PLC), ar trebui analizate \u0219i\ntestate pentru identificarea practicilor de codificare nesigure \u0219i\nconfigura\u021biile implicite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea procedurilor opera\u021bionale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesele <\/span>\u0219i <\/span>procedurile, <\/span>\u00een <\/span>special <\/span>cele <\/span>care <\/span>implic\u0103\n<\/span>accesul <\/span>la <\/span>distan\u021b\u0103,\n<\/span>mentenan\u021ba <\/span>\u0219i opera\u021biunile de\nur<\/span>gen\u021b\u0103, ar <\/span>trebui revizuite pentru ident<\/span>ificarea\npunctelor slabe care ar putea afecta integritatea sistemului OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 stabilea<\/span>sc\u0103 \u0219i s\u0103 men\u021bin\u0103 un proces docume<\/span>ntat care s\u0103 permit\u0103 ca vulnerabilit\u0103\u021bile\ns\u0103 fie revizuite, analizate \u0219i rem<\/span>ediate\n\u00een mod continuu \u0219i care s\u0103 prevad\u0103 schimbul de informa\u021bii, acolo unde este\ncazul.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a asigura\n<\/span>c\u0103 <\/span>vulnerabilit\u0103\u021bile <\/span>sunt <\/span>reviz<\/span>uite, <\/span>analizate <\/span>\u0219i <\/span>remediate\n\u00een mod continuu, printr-un proces documen<\/span>tat\ncare sprijin\u0103, acolo unde <\/span>este cazul,\n\u0219i schimbul de informa\u021bii.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cencorporarea <\/span>lec\u021biilor\n\u00eenv\u0103\u021bate \u0219i a amenin\u021b\u0103rilor emer<\/span>gente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesul <\/span>ar <\/span>trebui <\/span>actualizat <\/span>\u00een <\/span>func\u021bie <\/span>d<\/span>e <\/span>incidente, <\/span>modific\u0103ri <\/span>tehnologice <\/span>\u0219i <\/span>amenin\u021b\u0103ri <\/span>\u00een continu\u0103 evolu\u021bie, inclusiv ce<\/span>le care vizeaz\u0103 sistemele OT <\/span>\u0219i protocoalele industriale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea observa\u021biilor inter<\/span>ne \u0219i a indicatorilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Rezultatele <\/span>auditului, <\/span>indicatorii <\/span>\u0219i <\/span>observa\u021biile <\/span>operatorilor <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>pentru <\/span>rafinarea procesului de\nmanagement al vulner<\/span>abilit\u0103\u021bilor<\/span>, \u00een special \u00een cazul \u00een care procesele\nmanuale sunt frecvente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea SBOM<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>SBOM-urile <\/span>ar <\/span>trebui <\/span>utilizate <\/span>pentru <\/span>a <\/span>identifica <\/span>componentele <\/span>vulnerabile <\/span>at\u00e2t <\/span>\u00een <\/span>stivele\n<\/span>de software IT<\/span>, c\u00e2t \u0219i OT<\/span>, inclusiv sistemele integrate \u0219i firmware<\/span>-ul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea surselor de informa\u021bii privind\namenin\u021b\u0103rile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sursele <\/span>de <\/span>\u00eencredere,\n<\/span>precum <\/span>avizele <\/span>v\u00e2nz\u0103torilor<\/span>, <\/span>echipa <\/span>de <\/span>r\u0103spuns <\/span>la <\/span>incidente <\/span>cibernetice pentru sisteme de control\nindustrial (ICS-CER<\/span>T) \u0219i ENISA, ar\ntrebui monitorizate pentru identificarea vulnerabilit\u0103\u021bilor care afecteaz\u0103\nprodusele OT<\/span>, sistemele de control\n\u0219i dispozitivele de teren.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea p<\/span>roceselor\n\u0219i procedurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile <\/span>opera\u021bionale<\/span>, <\/span>\u00ee<\/span>n <\/span>special <\/span>cele <\/span>care <\/span>implic\u0103\n<\/span>acce<\/span>sul <\/span>la <\/span>distan\u021b\u0103, <\/span>mentenan\u021ba <\/span>\u0219i func\u021biile critice pentru siguran\u021b\u0103, ar trebui revizuite\npentru identificarea punctelor slabe care pot fi exploatate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Coordonarea cu departamentele de inginerie \u0219i\nopera\u021biuni<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Eforturile <\/span>de <\/span>remediere <\/span>ar <\/span>trebui <\/span>planificate <\/span>\u00een <\/span>coordonare <\/span>cu <\/span>echipele <\/span>OT <\/span>\u0219i <\/span>de <\/span>ingineri <\/span>pentru evitarea perioadelor de\nnefunc\u021bionare <\/span>neplanificate sau\nriscurilor de siguran\u021b\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>opera\u021biunile <\/span>organiza\u021biei <\/span>nu <\/span>sunt <\/span>afectate\n<\/span>negativ <\/span>de <\/span>procesul\n<\/span>de <\/span>te<\/span>stare, <\/span>testele <\/span>de performan\u021b\u0103\/\u00eenc\u0103rcare \u0219i testele de\npenetrare asupra sistemelor organiza\u021biei trebuie efectuate cu aten\u021bie.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>tes<\/span>tele <\/span>de <\/span>performan\u021b\u0103\/\u00eenc\u0103rcare <\/span>\u0219i <\/span>testele <\/span>de <\/span>penetrare\nsunt realizate cu aten\u021bie pentru evitarea perturb\u0103rii opera\u021biunilor sau a\ncompromite<\/span>rii stabilit\u0103\u021bii\nsistemului, \u00een special \u00een mediile care includ sisteme crit<\/span>ice pentru activitate sau pentru\nsiguran\u021b\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate <\/span>\u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea \u0219i men\u021binerea programelor de testare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Programele <\/span>de <\/span>testare\n<\/span>pentru <\/span>testarea <\/span>performan\u021bei\/\u00eenc\u0103rc\u0103ri<\/span>i <\/span>\u0219i <\/span>testarea\n<\/span>penetr\u0103rii <\/span>ar <\/span>trebui adaptate <\/span>la <\/span>dimensiunea,\ncomplexitatea <\/span>\u0219i <\/span>maturitatea <\/span>or<\/span>ganiza\u021biei, <\/span>inclusiv\n<\/span>la <\/span>cons<\/span>tr\u00e2ngerile specifice OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea mediilor de testare controlate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>estele <\/span>de <\/span>penetrare\n<\/span>ar <\/span>trebui <\/span>efectuate\n<\/span>\u00een <\/span>medii <\/span>izolate\n<\/span>sau <\/span>controlate, <\/span>acolo <\/span>unde <\/span>este <\/span>posibil,\npentru preve<\/span>nirea impactului\nneinten\u021bionat asupra sistemelor O<\/span>T <\/span>active.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Angajarea de hacke<\/span>ri\netici califica\u021bi<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Hackerii <\/span>etici <\/span>experimenta\u021bi <\/span>ar <\/span>trebui <\/span>folosi\u021bi\n<\/span>pentru <\/span>efectuarea <\/span>testelor\n<\/span>de <\/span>penetrare, <\/span>\u00een <\/span>special\n\u00een medii OT <\/span>complexe sau sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>alidarea m\u0103surilor de securitate dup\u0103 testare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dup\u0103 <\/span>testare, <\/span>controalele <\/span>de <\/span>securitate <\/span>ar <\/span>trebui <\/span>rev<\/span>alidate <\/span>pentru <\/span>a <\/span>confirma\n<\/span>c\u0103 <\/span>m\u0103surile <\/span>de protec\u021bie r\u0103m\u00e2n eficace \u0219i c\u0103 nu au\navut loc modific\u0103ri neinten\u021bionate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Diferen\u021ba\nfa\u021b\u0103 de ID.RA-01.5 (CyFun\u00ae Important)<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen timp ce ID.RA-01.4 se\nconcentrea<\/span>z\u0103 asupra activit\u0103\u021bilor de\ntestare, precum testele de penetr<\/span>are\n\u0219i testele de performan\u021b\u0103\/\u00eenc\u0103rcare, care sunt de regul\u0103 planificate, realizate\nmai rar \u0219i adesea realizate \u00een <\/span>medii <\/span>controlate, ID.RA-01.5 <\/span>abordeaz\u0103 efectuarea <\/span>\u00een <\/span>condi\u021bii <\/span>de <\/span>siguran\u021b\u0103 <\/span>a <\/span>scan\u0103rii\nvulnerabilit\u0103\u021bilor, care este mai frecvent\u0103, adesea aut<\/span>omatizat\u0103 \u0219i trebuie gestionat\u0103 cu aten\u021bie pentru evitarea\nperturb\u0103rilor neinten\u021bionate \u00een sistemele OT aflate \u00een produc\u021bie.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-01.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Scanarea vulnerabilit\u0103\u021bilor nu trebuie s\u0103 afecteze\nnegativ func\u021biile sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>scanarea <\/span>vulnerabilit\u0103\u021bilor <\/span>nu <\/span>perturb\u0103 <\/span>sau <\/span>degradeaz\u0103\nperforman\u021ba <\/span>sistemelor critice <\/span>pentru <\/span>activitate, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>mediile <\/span>OT <\/span>\u00een <\/span>care <\/span>stabilitatea <\/span>\u0219i disponibilitatea sistemului sunt\ncritice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Programarea scan\u0103rilor \u00een perioadele cu utilizare\nredus\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Scan\u0103rile <\/span>ar <\/span>trebui <\/span>efectuate <\/span>\u00een <\/span>afara <\/span>orelor\n<\/span>de <\/span>v\u00e2rf <\/span>sau <\/span>\u00een <\/span>perioadele <\/span>de <\/span>mentenan\u021b\u0103 <\/span>planificate, pentru minimizarea\nimpactului opera\u021bional.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea instrumentelor de scanare neintruzive<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>ar <\/span>trebui <\/span>selectate <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>capacitatea <\/span>lor <\/span>de <\/span>a <\/span>scana <\/span>f\u0103r\u0103 <\/span>a <\/span>supra\u00eenc\u0103rca resursele sistemului sau a\ninterfe<\/span>ra cu opera\u021biunil<\/span>e \u00een timp rea<\/span>l.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea ini\u021bial\u0103 \u00een <\/span>medii de\ntestare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Scan\u0103rile <\/span>ar <\/span>trebui\n<\/span>testate <\/span>\u00een <\/span>medii\n<\/span>care <\/span>nu <\/span>sunt <\/span>de <\/span>produc\u021bie <\/span>pentru <\/span>identificarea <\/span>poten\u021bialelor probleme \u00eenainte de punerea\n\u00een func\u021biune \u00een siste<\/span>mele aflate \u00een\nproduc\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea scan\u0103rii incrementale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Scanarea <\/span>ar <\/span>trebui <\/span>\u00eemp<\/span>\u0103r\u021bit\u0103 <\/span>\u00een <\/span>se<\/span>gmente\n<\/span>mai <\/span>mici, <\/span>u\u0219or <\/span>de <\/span>gestionat, <\/span>pentru <\/span>reducerea\n\u00eenc\u0103rc\u0103rii sistemului \u0219i evitarea suprasolicit\u0103rii componentelor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea performan\u021bei sistemului \u00een timpul\nscan\u0103rilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comportamentul <\/span>sistemului <\/span>ar <\/span>trebui <\/span>monitorizat <\/span>activ <\/span>\u00een <\/span>timpul <\/span>scan\u0103r<\/span>ii <\/span>pentru <\/span>detec\u021bia\n<\/span>\u0219i r\u0103spunsul la orice degradare <\/span>a\nperforman\u021bei sau anomalii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Diferen\u021ba\nfa\u021b\u0103 de ID.RA-01.4 (CyFun\u00ae Esen\u021b<\/span>ial)<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen timp ce ID.RA-01.4 se concentrea<\/span>z\u0103 asupra activit\u0103\u021bilor de testare,\nprecum testele de penetrare \u0219i testele de performan\u021b\u0103\/\u00eenc\u0103<\/span>rcare, care sunt de regul\u0103 planificate,\nrealizate mai rar \u0219i adesea realizate \u00een <\/span>medii <\/span>controlate, ID.RA-01.5 <\/span>abordeaz\u0103 efectuarea <\/span>\u00een <\/span>condi\u021bii <\/span>de <\/span>siguran\u021b\u0103 <\/span>a <\/span>scan\u0103rii\nvulnerabilit\u0103\u021bilor, care este mai frecvent\u0103, adesea automatiz<\/span>at\u0103 \u0219i trebuie gestionat\u0103 cu <\/span>aten\u021bie pentru evitarea perturb\u0103rilor\nneinten\u021bionate \u00een sistemele OT aflate \u00een produc\u021bie.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-01.6<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Vulnerabilit\u0103\u021bile  <\/span>trebuie \n<\/span>identificate  <\/span>\u0219i  <\/span>gestionate \n<\/span>\u00een  <\/span>toate <\/span>activele <\/span>relevante,  <\/span>inclusiv \n<\/span>software, arhitecturi de re\u021bea \u0219i de sistem \u0219i incinte.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>identificarea <\/span>\u0219i <\/span>gestionarea <\/span>sistematic\u0103 <\/span>a <\/span>vulnerabilit\u0103\u021bilor la nivelul tuturor\nactivelor relevante, inclusiv software, arhitecturi de re\u021bea \u0219i de sistem,\nprecum \u0219i incintele. Aceasta se bazeaz\u0103 <\/span>pe\nControlul ID.RA-01.1, care se concentreaz\u0103 pe identificarea at\u00e2t a\namenin\u021b\u0103rilor, c\u00e2t \u0219i a vulnerabilit\u0103\u021bilor, pentru sprijinirea red<\/span>ucerii riscuri<\/span>lor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Extinderea domen<\/span>iului\nde aplicare al managementului vulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea <\/span>\u0219i <\/span>remedierea <\/span>vulnerabilit\u0103\u021bilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>acopere\n<\/span>toate <\/span>activele <\/span>relevante, inclusiv <\/span>sistemele <\/span>IT \u0219i <\/span>OT<\/span>, <\/span>aplica\u021biile, <\/span>arhitecturile <\/span>de <\/span>re\u021bea <\/span>\u0219i <\/span>incintele\n<\/span>care <\/span>sus\u021bin opera\u021biunile <\/span>critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unui proces dedicat de management al\nvulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>un <\/span>proces <\/span>structurat <\/span>pentru <\/span>urm<\/span>\u0103rirea,\n<\/span>evaluarea <\/span>\u0219i <\/span>atenuarea\n<\/span>continu\u0103 <\/span>a vulnerabilit\u0103\u021bilor<\/span>, distinct de activit\u0103\u021bile de informa\u021bii\nprivind amenin\u021b\u0103rile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Diferen\u021bierea \u00eentre informa\u021biile privind amenin\u021b\u0103rile\n\u0219i managementul vulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>men\u021binute  <\/span><\/span>procese\n <\/span><\/span>sau\n <\/span><\/span>dovezi\n <\/span><\/span>separate\n <\/span><\/span>pentru\n <\/span><\/span>a\n <\/span><\/span>distinge\n <\/span><\/span>\u00eentre\n <\/span><\/span>identificarea\namenin\u021b\u0103rilor <\/span>externe <\/span>(de <\/span>exemplu, <\/span>actorii\n<\/span>de <\/span>amenin\u021bare, <\/span>campaniile) <\/span>\u0219i <\/span>gestionarea <\/span>puncte<\/span>lor\nslabe interne (de exemplu, sistemele neactualizate, configura\u021biile incorecte).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu un proces mai amplu de management al\nriscului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesul <\/span>de <\/span>management <\/span>al <\/span>vulnerabilit\u0103\u021bilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>aliniat\n<\/span>cu <\/span>cadrul <\/span>general\n<\/span>de management al riscului al or<\/span>ganiza\u021biei\n\u0219i s\u0103 sprijine luarea deciziilor \u00een timp util.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea lu\u0103rii \u00een considerare a aspectelor\nspecifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>managementul <\/span>vulnerabilit\u0103\u021bilor <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>cont <\/span>de <\/span>sistemele <\/span>vechi, dependen\u021bele de v\u00e2nz\u0103tori \u0219i constr\u00e2ngerile opera\u021bionale\ncare ar putea limita op\u021biunile de aplicare a patch-urilor sau de scanare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Informa\u021biile <\/span>privind <\/span>amenin\u021b\u0103rile <\/span>cibernetice <\/span>sunt <\/span>ob\u021binute <\/span>din <\/span>forumuri <\/span>\u0219i <\/span>surse <\/span>de <\/span>schimb <\/span>de informa\u021bii.<\/span><\/p>\n\n

ID.RA-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>imp<\/span>lementat <\/span>un <\/span>program <\/span>de <\/span>con\u0219tientizare <\/span>a <\/span>amenin\u021b\u0103rilor <\/span>\u0219i <\/span>vulnerabilit\u0103\u021bilor <\/span>care <\/span>include <\/span>o capabilitate de schimb de informa\u021bii\n\u00eentre organiza\u021bii.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>consolida\n<\/span>capacitatea <\/span>organiza\u021biei <\/span>de <\/span>a <\/span>anticipa \u0219i <\/span>r\u0103spunde <\/span>la\namenin\u021b\u0103rile <\/span>cibernetice prin <\/span>implementarea <\/span>unui <\/span>program <\/span>de <\/span>con\u0219tientizare <\/span>a <\/span>amenin\u021b\u0103rilor <\/span>\u0219i vulnerabilit\u0103\u021bilor, care include\nschimbul de informa\u021bii \u00eentre organiza\u021bii.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103<\/span>toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea tacticilor actorilor de ame<\/span>nin\u021bare \u0219i vulnerabilit\u0103\u021bile emer<\/span>gente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Informa\u021biile <\/span>privind <\/span>amenin\u021b\u0103rile <\/span>cibernetice <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\n<\/span>informa\u021bii <\/span>actualizate <\/span>despre actorii de amenin\u021bare, tacticile,\nteh<\/span>nicile \u0219i <\/span>procedurile (TTP) ale a<\/span>cestora,\npre<\/span>cum \u0219i vulnerabilit\u0103\u021bile <\/span>tehnologiilor <\/span>emer<\/span>gente <\/span>(de <\/span>ex<\/span>emplu,\n<\/span>atacuri <\/span>bazate <\/span>pe <\/span>inteligen\u021ba <\/span>artif<\/span>icial\u0103,\notr\u0103virea datelor \u00een \u00eenv\u0103\u021barea automat\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unei colabor\u0103ri externe continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>men\u021bin\u0103 <\/span>o <\/span>participare <\/span>activ\u0103\n<\/span>\u00een <\/span>grupuri <\/span>de <\/span>securitate, <\/span>forumuri\n<\/span>\u0219i asocia\u021bii profesionale pentru a primi alerte, avize \u0219i opinii ale\ncolegilor relevante at\u00e2t pentru mediile IT<\/span>,\nc\u00e2t \u0219i pentru cele OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Facilitarea schimbului de informa\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Programul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>sprijine\n<\/span>schimbul <\/span>de <\/span>inf<\/span>orma\u021bii <\/span>neclasificate <\/span>\u0219i, <\/span>acolo <\/span>unde <\/span>este <\/span>cazul, clasificate, despre vulnerabilit\u0103\u021bi\n\u0219i incidente \u00eentre departamente \u0219i cu parteneri externi de \u00eencredere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea con\u0219tientiz\u0103rii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Informa\u021biile <\/span>privind <\/span>amenin\u021b\u0103rile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>surse <\/span>specifice <\/span>OT <\/span>(de <\/span>exemplu, <\/span>ICS<\/span>– CER<\/span>T<\/span>, <\/span>avize\nale v\u00e2nz\u0103torilor) pentru a aborda vulnerabilit\u0103\u021bile ICS, dispozitivele vechi \u0219i\ntehnologiile <\/span>specifice <\/span>sectorului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Diferen\u021bierea informa\u021biil<\/span>or privind amenin\u021b\u0103rile de managementul vulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Programul  <\/span><\/span>de  <\/span><\/span>con\u0219tientizare  <\/span><\/span>ar  <\/span><\/span>tr<\/span>ebui  <\/span><\/span>s\u0103  <\/span><\/span>co<\/span>mpleteze\n <\/span><\/span>procesele\n <\/span><\/span>de\n <\/span><\/span>management\n <\/span><\/span>al\nvulnerabilit\u0103\u021bilor<\/span>, <\/span>dar <\/span>s\u0103 <\/span>r\u0103m\u00e2n\u0103\n<\/span>distinct <\/span>de <\/span>acestea,\n<\/span>concentr\u00e2ndu-se <\/span>pe <\/span>evolu\u021bia\n<\/span>amenin\u021b\u0103rilor externe \u0219i pe informa\u021bii strategice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>implementate <\/span>mecanisme <\/span>automatizate <\/span>p<\/span>entru <\/span>difuzarea\n<\/span>alertelor <\/span>\u0219i <\/span>avizelor\n<\/span>de <\/span>securitate c\u0103tre p\u0103r\u021bile <\/span>interesate relevante ale organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 alertele \u0219i avizele de securitate sunt transmise\nprompt \u0219i <\/span>\u00een <\/span>mod <\/span>fiabil <\/span>p\u0103r\u021bilor <\/span>interesate\nrelevante <\/span>prin mecanisme automatizate,\npermi\u021b\u00e2nd con\u0219tientizarea \u0219i reac\u021bia \u00een timp util \u00een cadrul organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea platformelor de <\/span>securitate centralizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Solu\u021bii <\/span>precum <\/span>managementul <\/span>informa\u021biei <\/span>\u0219i <\/span>evenimentelor <\/span>de <\/span>securitate <\/span>(SIEM), <\/span>detec\u021bie <\/span>\u0219i r\u0103spuns\n<\/span>extinse <\/span>(XDR), <\/span>orchestrare, <\/span>automatiz<\/span>are <\/span>\u0219i <\/span>r\u0103spuns <\/span>\u00een <\/span>securitate <\/span>(SOAR) <\/span>sau <\/span>analiza comportamentului utilizatorilor \u0219i\nentit\u0103\u021bilor (<\/span>U<\/span>EBA) ar tre<\/span>bui\nutilizate pentru a colecta, analiza \u0219i corela alertele din mai multe surse,\ninclusiv sisteme OT <\/span>\u0219i IT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea distribu\u021biei alertelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Alertele <\/span>ar <\/span>trebui <\/span>configurate <\/span>pentru <\/span>notificarea <\/span>autom<\/span>at\u0103 <\/span>a <\/span>p\u0103r\u021bilor <\/span>interesate <\/span>prin <\/span>e<\/span>-mail, platforme de mesagerie sau alte\ncanale, pentru asigur<\/span>area disemin\u0103rii\nrapide a informa\u021biilor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea tablourilor de bord \u00een timp real<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ablourile <\/span>de <\/span>bord <\/span>ar <\/span>trebui <\/span>implementate <\/span>pentru <\/span>a <\/span>oferi <\/span>vizibilitate <\/span>continu\u0103 <\/span>asupra <\/span>alertelor \u0219i avizelor de securitate,\nsprijinind con\u0219tientizarea situa\u021biei \u0219i luarea deciziilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu platformele de r\u0103spuns la incidente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mecanismele <\/span>automatizate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>sprijine <\/span>distribuirea <\/span>alertelor <\/span>c\u0103tre <\/span>echipele\n<\/span>de <\/span>r\u0103spuns la <\/span>incidente,\n<\/span>asigur\u00e2nd <\/span>c\u0103 <\/span>acestea <\/span>dispun <\/span>de <\/span>cele <\/span>mai <\/span>recente\ninforma\u021bii <\/span>pentru <\/span>a <\/span>ac\u021biona <\/span>\u00een mod eficace.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Extragerea din surse externe de informa\u021bii privind\namenin\u021b\u0103rile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>automatizate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>extrag\u0103 <\/span>date <\/span>din <\/span>surse <\/span>externe <\/span>de <\/span>\u00eencredere <\/span>pentru <\/span>a\n\u00eembog\u0103\u021bi alertele interne cu un conte<\/span>xt\nmai lar<\/span>g <\/span>al amenin\u021b\u0103rilor<\/span>,\ninclusiv avize specifice OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Amenin\u021b\u0103rile interne \u0219i externe la ad<\/span>resa organiza\u021biei sunt identificate \u0219i\n\u00eenregistrate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

ID.RA-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Amenin\u021b\u0103rile <\/span>trebuie <\/span>identificate <\/span>\u0219i <\/span>evaluate <\/span>\u00een <\/span>raport <\/span>cu <\/span>toate <\/span>activele <\/span>relevante, <\/span>inclusiv <\/span>software<\/span>– ul, arhitecturile de re\u021bea \u0219i de sistem\n\u0219i incintele.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 amenin\u021b\u0103rile sunt identificate \u0219i evaluate \u00een mo<\/span>d sistematic <\/span>\u00een <\/span>raport <\/span>cu <\/span>toate <\/span>activele\n<\/span>relevante, <\/span>inclusiv <\/span>softwa<\/span>re-ul, <\/span>arhitec<\/span>turile <\/span>de <\/span>re\u021bea <\/span>\u0219i <\/span>de <\/span>sistem, precum \u0219i incintele. A<\/span>ceasta se bazeaz\u0103 pe ID.RA<\/span>-01.1, care stabile\u0219te fundamentul pentru identificarea\nat\u00e2t a amenin\u021b\u0103rilor, c\u00e2t \u0219i a vulnerabilit\u0103\u021bilor la nivelul activelor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestu<\/span>i obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Extinderea identific\u0103rii amenin\u021b\u0103rilor la toate\nactivele<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Amenin\u021b\u0103rile <\/span>ar <\/span>trebui <\/span>evaluate <\/span>\u00een <\/span>raport <\/span>cu <\/span>toate <\/span>activele <\/span>rel<\/span>evante, <\/span>inclusiv <\/span>sistemele <\/span>IT <\/span>\u0219i<\/span><\/p>\n\n

 <\/span><\/p>\n\n

OT<\/span>, aplica\u021biile, arhitecturile de re\u021bea \u0219i\ninci<\/span>ntele care sus\u021bin opera\u021biunile\ncritice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unui proces dedicat de in<\/span>forma\u021bii privind amenin\u021b\u0103rile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>un <\/span>proces <\/span>structurat <\/span>pentru <\/span>colectarea, <\/span>analizarea <\/span>\u0219i <\/span>evaluarea <\/span>informa\u021biilor privind amenin\u021b\u0103rile din\nsurse interne \u0219i externe, i<\/span>nclusiv\navize specifice sectorului \u0219i fluxuri de informa\u021bii privind amenin\u021b\u0103rile axate\npe OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Diferen\u021bierea informa\u021biil<\/span>or privind amenin\u021b\u0103rile de managementul vulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Informa\u021biile  <\/span> <\/span><\/span>privind  <\/span> <\/span><\/span>amenin\u021b\u0103rile  <\/span> <\/span><\/span>ar \n<\/span> <\/span><\/span>trebui \n<\/span> <\/span><\/span>gestionate  <\/span> <\/span><\/span>separat \n<\/span> <\/span><\/span>de \n<\/span> <\/span><\/span>managementul vulnerabilit\u0103\u021bilor<\/span>, <\/span>cu <\/span>procese\n<\/span>\u0219i <\/span>dovezi <\/span>distincte pentru <\/span>a <\/span>asigura <\/span>claritatea <\/span>\u0219i <\/span>concentrarea.\nAmenin\u021b\u0103rile <\/span>se <\/span>refer\u0103\n<\/span>la <\/span>poten\u021biali <\/span>actori\n<\/span>sau <\/span>evenimente, <\/span>\u00een <\/span>timp <\/span>ce <\/span>vulnerabilit\u0103\u021bile <\/span>se <\/span>refer\u0103\nla puncte slabe care ar putea fi exploatate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu analiza riscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Amenin\u021b\u0103rile <\/span>identificate <\/span>ar <\/span>trebui <\/span>corelate\n<\/span>cu <\/span>vulnerabilit\u0103\u021bile <\/span>cunoscute\n<\/span>\u0219i <\/span>\u00eenregistra<\/span>te <\/span>\u00eentr-\nun <\/span>registru <\/span>central <\/span>de <\/span>riscuri <\/span>pentru\na <\/span>sprijini <\/span>stabilirea <\/span>priorit\u0103\u021bilor <\/span>\u0219i <\/span>planificarea <\/span>m\u0103surilor de atenuare, astfel cum se\nprevede \u00een ID.<\/span>RA-01.1.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea amenin\u021b\u0103rilor specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile amenin\u021b\u0103rilor ar trebui s\u0103 considere riscurile\nspecifice OT<\/span>, precum compromiterea\nlan\u021bului <\/span>de <\/span>aprovizionare, <\/span>accesul <\/span>la <\/span>distan\u021b\u0103 <\/span>neautorizat <\/span>\u0219i <\/span>exploatarea <\/span>sistemelor <\/span>vechi <\/span>sau <\/span>a protocoalelor proprietare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Amenin\u021b\u0103rile, <\/span>vulnerabilit\u0103\u021bile, <\/span>probabilit\u0103\u021bile <\/span>\u0219i <\/span>impacturile <\/span>sunt <\/span>utilizate <\/span>pentru <\/span>\u00een\u021belegerea <\/span>riscului inerent \u0219i pentru stabilire<\/span>a priorit\u0103\u021bilor \u00een ceea ce prive\u0219te\nr\u0103spunsul la risc<\/span>uri.<\/span><\/p>\n\n

ID.RA-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia  <\/span><\/span>trebuie  <\/span><\/span>s\u0103  <\/span><\/span>efectueze\n <\/span><\/span>eval<\/span>u\u0103ri  <\/span><\/span>ale  <\/span><\/span>riscurilor  <\/span><\/span>\u00een  <\/span><\/span>care  <\/span><\/span>riscul\n <\/span><\/span>este\n <\/span><\/span>dete<\/span>rminat  <\/span><\/span>pe  <\/span><\/span>baza amenin\u021b\u0103rilor, vulnerabilit\u0103\u021bilor\n\u0219i impactului asupra proceselor \u0219i activelor organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c<\/span>\u0103\nevalu\u0103rile riscurilor sunt realizate prin evaluarea amenin\u021b\u0103rilor,\nvulnerabilit\u0103\u021bilor \u0219i impactului poten\u021bial al acestora asupra proceselor \u0219i\nactivelor organiza\u021biei. Acest obiec<\/span>tiv\nsprijin\u0103 luarea de decizii informat<\/span>e\n\u0219i atenuare<\/span>a eficace a riscurilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identificarea amenin\u021b\u0103rilor \u0219i vulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>ame<\/span>nin\u021b\u0103rile <\/span>\u0219i <\/span>vulnerabilit\u0103\u021bile <\/span>din <\/span>arhitecturile <\/span>software,\n<\/span>de re\u021bea \u0219i de sistem, precum \u0219i din incintele care g\u0103zduiesc active\ninformatice critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea impactului asupra activit\u0103\u021bii or<\/span>ganiza\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Impactul <\/span>poten\u021bial\n<\/span>asupra <\/span>opera\u021biunilor <\/span>or<\/span>ganiza\u021biei, <\/span>serviciilor <\/span>\u0219i <\/span>activelor <\/span>or<\/span>ganiza\u021biei <\/span>ar trebui analizat pentru a determina\ngravitatea <\/span>fiec\u0103rui risc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea factorilor umani<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comportamentul <\/span>uman <\/span>ar <\/span>trebui <\/span>luat <\/span>\u00een <\/span>considerare <\/span>la <\/span>proiectarea <\/span>\u0219i <\/span>aplicarea <\/span>politicilor <\/span>de securitate, \u00een special \u00een mediile OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i revizuirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>ri<\/span>scurilor <\/span>ar <\/span>trebui <\/span>documentate, <\/span>reviz<\/span>uite <\/span>periodic\n<\/span>\u0219i <\/span>actualizate <\/span>pentru <\/span>a <\/span>reflecta modific\u0103rile <\/span>survenite \u00een sisteme, opera\u021biuni sau\npeisajul amenin\u021b\u0103rilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-05.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie <\/span>s\u0103 efectueze \u0219i documenteze evalu\u0103rile\nriscurilor <\/span>\u00een cadrul c\u0103rora riscul\neste determinat pe baza amenin\u021b\u0103r<\/span>ilor,\nvulnerabilit\u0103\u021bilor, impactului asupra proceselor \u0219i activelor organiza\u021biei,\nprecum \u0219i a probabilit\u0103\u021bii de producere a acestora.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 evalu\u0103rile riscurilor sunt realizate \u0219i\ndocumentate utiliz\u00e2nd o abordare structurat\u0103 care ia \u00een considerare\namenin\u021b\u0103rile, vulnerabilit\u0103\u021bile, impactul asupra activit\u0103\u021bii organiza\u021biei \u0219i\nprobabilitatea de producere. Aceasta sprijin\u0103 luarea de decizii informate \u0219i\nprioritizarea <\/span>eforturilor de\nsecuritate ciberne<\/span>tic\u0103 \u00een mediile IT\n\u0219i OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea amenin\u021b\u0103rilor interne \u0219i externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>riscurilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare <\/span>at\u00e2t <\/span>amenin\u021b\u0103rile <\/span>provenite\n<\/span>din <\/span>interiorul or<\/span>ganiza\u021biei, c\u00e2t \u0219i pe cele provenite de la\nactori externi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea metodelor recunoscute de analiz\u0103 a\nriscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span> <\/span><\/span>trebui  <\/span> <\/span><\/span>utilizate  <\/span> <\/span><\/span>metode \n<\/span> <\/span><\/span>calitative  <\/span> <\/span><\/span>\u0219i\/sau \n<\/span> <\/span><\/span>cantitative,  <\/span> <\/span><\/span>precum \n<\/span> <\/span><\/span>modelul \n<\/span> <\/span><\/span>persoane, echipamente, software, date,\nor<\/span>ganiza\u021bie, mediu, <\/span>servicii (MAPGOOD), <\/span>ISO\/IEC 27005 sau metoda <\/span>de <\/span>evaluare <\/span>a <\/span>riscurilor\n<\/span>CIS. <\/span>Aceste <\/span>metode <\/span>pot <\/span>fi <\/span>sprijinite <\/span>de <\/span>instrumente <\/span>software de management al riscului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Prioritizarea pe baza probabilit<\/span>\u0103\u021bii \u0219i impactului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Resursele <\/span>\u0219i <\/span>investi\u021biile <\/span>\u00een <\/span>securitatea <\/span>cibern<\/span>etic\u0103 <\/span>ar <\/span>trebui <\/span>alocate\n<\/span>pe <\/span>baza <\/span>probabilit\u0103\u021bii estimate a amenin\u021b\u0103rilor \u0219i a impactului\npoten\u021bial asupra proceselor or<\/span>ganiza\u021biei\n\u0219i a activelor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Luarea \u00een co<\/span>nsiderare\na riscurilor specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>ri<\/span>scurilor\n<\/span>ar <\/span>tr<\/span>ebui <\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>cont <\/span>de <\/span>factori <\/span>specifici\n<\/span>OT<\/span>, <\/span>precum <\/span>implica\u021biile <\/span>asupra siguran\u021bei, disponibilitatea\nsistemului, tehnologiil<\/span>e vechi \u0219i\nconstr\u00e2ngerile opera\u021bionale<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-05.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rezultatele evalu\u0103rii riscurilor trebuie comunicate\np\u0103r\u021bilor interesate relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>rezultatele <\/span>evalu\u0103rii <\/span>riscuril<\/span>or <\/span>sunt <\/span>comunicate <\/span>\u00een <\/span>mod\neficace p\u0103r\u021bilor interesa<\/span>te\nrelevante, permi\u021b\u00e2nd luarea de decizii informate \u0219i adoptarea de r\u0103spunsuri\ncoordonate \u00een cadrul organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea unui plan sau a unei proceduri de comunicare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un <\/span>proces <\/span>documentat <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>specifice <\/span>modul<\/span>, <\/span>momentul\n<\/span>\u0219i <\/span>destinatarii <\/span>comunic\u0103rii informa\u021biilor <\/span>legate <\/span>de <\/span>ri<\/span>scu<\/span>ri. <\/span>Acesta <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>at\u00e2t <\/span>p\u0103r\u021bi <\/span>interesate <\/span>interne, <\/span>c\u00e2t <\/span>\u0219i externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea unei comuni<\/span>c\u0103ri\nclare \u0219i \u00een timp util<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Informa\u021biile privind riscurile ar trebui comunicate prompt \u0219i\n\u00eentr<\/span>-un format u\u0219or de \u00een\u021beles, \u00een\nspecial pentru p\u0103r\u021bile interesa<\/span>te\nf\u0103r\u0103 cuno\u0219tin\u021be tehnice, im<\/span>plicate\n\u00een procesul decizional opera\u021bional sau strategic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea informa\u021biilor de cont<\/span>act\nale p\u0103r\u021bilor interesate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>de <\/span>contact <\/span>ale <\/span>p\u0103r\u021bilor <\/span>interesate <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>cel <\/span>pu\u021bin <\/span>anual <\/span>pentru <\/span>asigurarea acurate\u021bei <\/span>\u0219i <\/span>fiabilit\u0103\u021bii <\/span>comunic\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea nevoilor de comunicare specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile <\/span>de <\/span>comunicare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>cont <\/span>de <\/span>rolurile\n<\/span>specifice <\/span>OT<\/span>, <\/span>precum <\/span>echipele\n<\/span>de ingineri, mentenan\u021b\u0103 \u0219i opera\u021biuni, asigur\u00e2nd c\u0103 acestea primesc\ninforma\u021bii relevan<\/span>te privind\nriscurile legate de disponibilitatea, siguran\u021ba \u0219i continuitatea sistemului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

R\u0103spunsurile la riscuri sunt selectate, prioritizate,\nplanificate, urm\u0103rite \u0219i comunicate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

R\u0103spunsurile la riscuri trebuie identificate, prioritiz<\/span>ate, planificate, urm\u0103rite \u0219i comunicate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 r\u0103spunsurile la riscuri sunt identifica<\/span>te \u00een mod clar, prioritizate,\nplanificate, urm\u0103rite \u0219i comunicate, pentru sprijinirea aten<\/span>u\u0103r<\/span>ii <\/span>eficace a riscurilor \u0219i luarea de decizii\ninformate \u00een cadrul organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea criteriilor de r\u0103spuns la riscuri<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Deciziile <\/span>de <\/span>acceptare, <\/span>transfer<\/span>, <\/span>atenu<\/span>are <\/span>sau <\/span>ev<\/span>itare a <\/span>riscurilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>criteriile de <\/span>management <\/span>al <\/span>vulnerabilit\u0103\u021bilor <\/span>ale <\/span>or<\/span>ganiza\u021biei, <\/span>astfel <\/span>cum <\/span>sunt <\/span>men\u021bionate <\/span>\u00een <\/span>ID.RA<\/span>–<\/span><\/p>\n\n

08.1.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Selectarea cu aten\u021bie a controalelor compensatorii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>cazul <\/span>\u00een <\/span>care <\/span>atenuarea\n<\/span>direct\u0103 <\/span>nu <\/span>este <\/span>fezabil\u0103, <\/span>controa<\/span>le <\/span>compensatorii <\/span>ar <\/span>trebui selectate pe\nbaza acelora\u0219i criterii pentru asigurar<\/span>ea\nunei reduceri consistente a riscurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Fundamentarea m\u0103surilor pe rezultatele evalu\u0103rilor\nriscurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>deciziile <\/span>privind <\/span>r\u0103spunsul <\/span>la <\/span>riscuri <\/span>ar <\/span>trebui <\/span>fundamentate <\/span>pe <\/span>r<\/span>ezultatele <\/span>evalu\u0103rilor riscurilor documentate, asigur\u00e2nd alinierea cu amenin\u021b\u0103rile,\nvulnerabilit\u0103\u021bile \u0219i impactul real asupra activit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Urm\u0103rirea progresului\n<\/span>implement\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103surile <\/span>de <\/span>r\u0103spuns\n<\/span>la <\/span>riscuri <\/span>ar <\/span>trebui <\/span>urm\u0103rite\n<\/span>folosind <\/span>instrumente <\/span>structurat<\/span>e, <\/span>prec<\/span>um <\/span>un registru de riscuri, un plan de ac\u021biune\n\u0219i e<\/span>tape cheie sau rapoarte detaliate\nprivind riscurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Comunicare<\/span>a\n\u00een ordinea priorit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>R\u0103spunsurile <\/span>planificate <\/span>la <\/span>riscuri <\/span>ar <\/span>trebui <\/span>comunicate <\/span>p\u0103r\u021bil<\/span>or <\/span>interesate <\/span>afectate <\/span>\u00een <\/span>ordinea priorit\u0103\u021bii, asigur\u00e2nd\ncon\u0219tientizarea \u0219i coordonarea \u00een timp util.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea considerentelor specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>R\u0103spunsurile <\/span>la <\/span>riscuri <\/span>\u00een <\/span>mediile <\/span>O<\/span>T <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>seama <\/span>de <\/span>constr\u00e2ngerile <\/span>opera\u021bionale, cerin\u021bele de siguran\u021b\u0103 \u0219i\ndispo<\/span>nibilitatea sistemului, \u00een <\/span>special atunci c\u00e2nd se planific\u0103 m\u0103suri de\natenuare sau de compensare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-08<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Procesele\npentru primirea, analizarea <\/span>\u0219i\nr\u0103spunsul la divulgarea vulnerabilit\u0103\u021bilor sunt stabilite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-08.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>stabileasc\u0103 <\/span>\u0219i <\/span>s\u0103 <\/span>implementeze <\/span>un <\/span>plan <\/span>d<\/span>e <\/span>management <\/span>al <\/span>vulnerabilit\u0103\u021bilor\npentru  <\/span> <\/span><\/span>identificarea,  <\/span> <\/span><\/span>analizarea,  <\/span> <\/span><\/span>evaluarea,  <\/span> <\/span><\/span>atenuarea  <\/span> <\/span><\/span>\u0219i \n<\/span> <\/span><\/span>comunicarea  <\/span> <\/span><\/span>tuturor \n<\/span> <\/span><\/span>tipurilor  <\/span> <\/span><\/span>de vulnerabilit\u0103\u021bi, inclusiv sub forma\nunui CVD, \u00een conformitate cu modalit\u0103\u021bile legale aplicabile. GHID DE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 toat<\/span>e\ntipurile de vulnerabilit\u0103\u021bi sunt identificate, analizate, evaluate, ate<\/span>nuate \u0219i comunicate \u00een mod sistematic,\nprintr<\/span>-un plan documentat de\nmanagement al vulnerabilit\u0103\u021bilor. Aceasta include gestionarea divulg\u0103rilor <\/span>\u00een conformitate cu practicile C<\/span>VD \u0219i cu cerin\u021bele legale aplicabile.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unui plan cuprinz\u0103tor de management al\nvulnerabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>acopere <\/span>vulner<\/span>abilit\u0103\u021bile <\/span>identificate <\/span>\u00een <\/span>urma <\/span>testelor\n<\/span>interne, <\/span>din <\/span>surse externe, precum buletinele de\nsecuritate, precum \u0219i din informa\u021biile divulgate de cercet\u0103tori, v\u00e2nz\u0103tori,\nparteneri sau or<\/span>ganisme\nguvernamentale responsabile cu securitatea cibernetic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Atribuire<\/span>a\nresponsabilit<\/span>\u0103\u021bilor \u0219i monitorizarea\nimplement\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>definite\n<\/span>roluri <\/span>clare <\/span>pentru <\/span>procesarea, <\/span>analizarea <\/span>\u0219i <\/span>r\u0103spunsul <\/span>la <\/span>vulnerabilit\u0103\u021bile\ndivulgate. <\/span>Implementarea <\/span>procedurilor <\/span>ar <\/span>trebui <\/span>monitorizat\u0103 <\/span>pentru <\/span>asigurarea <\/span>unei <\/span>gestion\u0103ri\nprompte \u0219i eficace.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea <\/span>CVD<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul <\/span>ar <\/span>tr<\/span>ebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>proceduri\n<\/span>pentru <\/span>primirea <\/span>\u0219i <\/span>r\u0103spunsul <\/span>la <\/span>rapoartele <\/span>privind vulnerabilit\u0103\u021bile din partea unor\np\u0103r\u021bi externe. Practicile CVD ar trebui s\u0103 fie aliniate cu recomand\u0103rile\nfurnizate de cadrul CVD elaborat de c\u0103tre ENISA, care prezint\u0103 aspecte\njuridice, tehnice \u0219i de comunicare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea acoperirii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul  <\/span><\/span>ar  <\/span><\/span>tr<\/span>ebui\n <\/span><\/span>s\u0103\n <\/span><\/span>abordeze\n <\/span><\/span>vulnerabilit\u0103\u021bile\n <\/span><\/span>din\n <\/span><\/span>mediile\n <\/span><\/span>OT<\/span>,  <\/span><\/span>inclusiv  <\/span><\/span>sistemele  <\/span><\/span>vechi,\ncomponentele <\/span>gestionate <\/span>de <\/span>v\u00e2nz\u0103tori <\/span>\u0219i <\/span>firmwa<\/span>re-ul <\/span>integrat, <\/span>unde <\/span>aplicarea <\/span>de <\/span>patch-uri <\/span>sau atenuarea vulnerabilit\u0103\u021bilor ar\nnecesita coordonarea cu echipele de ingineri.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.RA-08.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nimplementeze mecanisme <\/span>automatizate\npentru diseminarea \u0219i urm\u0103rirea m\u0103surilor corective leg<\/span>ate de <\/span>informa\u021biile\nprivind vulnerabilit\u0103\u021bile, care s\u0103 gestioneze automat colectarea datelor\nprivind vulnerabilit\u0103\u021bile, s\u0103 disemineze informa\u021bii, s\u0103 urm\u0103reasc\u0103 m\u0103surile\ncorective, s\u0103 includ\u0103 raportarea \u0219i r\u0103spunderea \u0219i s\u0103 permit\u0103 monitorizarea\ncontinu\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>informa\u021biile <\/span>referitoare <\/span>la <\/span>vulnerabilit\u0103\u021bi <\/span>sunt <\/span>colectate,\ndiseminate, urm\u0103rite \u0219i tratate \u00een mod automat, printr<\/span>-un proces documentat \u0219i automatizat de management al\nvulnerabilit\u0103\u021bilor. Ac<\/span>east<\/span>a includ<\/span>e\nfacilitarea monitoriz\u0103rii continue, raport\u0103rii \u0219i r\u0103spunderii pentru\nsprijinirea remedierii prompte \u0219i eficace.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea colect\u0103rii \u0219i distribuirii datelor\nprivind vulnerabilit\u0103\u021bile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Informa\u021biile  <\/span><\/span>privind  <\/span><\/span>vulnerabilit\u0103\u021bile  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>colectate\n <\/span><\/span>din\n <\/span><\/span>surse\n <\/span><\/span>interne\n <\/span><\/span>(de\n <\/span><\/span>exemplu,\naudituri, <\/span>scan\u0103ri <\/span>OT\/IT<\/span>) <\/span>\u0219i <\/span>surse <\/span>exte<\/span>rne <\/span>(de <\/span>exemplu, <\/span>avize <\/span>ale <\/span>ENISA, <\/span>fluxuri <\/span>de <\/span>informa\u021bii\nprivind <\/span>amenin\u021b\u0103rile, <\/span>buletine\n<\/span>ale <\/span>v\u00e2nz\u0103torilor). <\/span>A<\/span>ceste <\/span>informa\u021bii <\/span>ar <\/span>trebui <\/span>distribuite <\/span>automat p\u0103r\u021bilor <\/span>interesate <\/span>relevante\n<\/span>utiliz\u00e2nd <\/span>tablouri <\/span>de <\/span>bord, <\/span>alerte sau <\/span>instrumente <\/span>de <\/span>comunicare integrate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Urm\u0103rirea m\u0103surilor de remediere \u0219i monitorizarea\nprogresului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele  <\/span><\/span>automatizate  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>u<\/span>rm\u0103reasc\u0103  <\/span><\/span>implementarea  <\/span><\/span>m\u0103surilor\n <\/span><\/span>de\n <\/span><\/span>remediere,\nprecum aplicarea de patch<\/span>-uri,\nmodific\u0103ri de configurare sau controale compensatorii. Progresul ar trebui\nmonitorizat <\/span>pentru a asigura\nrezolvarea \u00een timp util.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Generarea de rapoarte \u0219i asigurarea r\u0103spunderii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>generate\n<\/span>rapoarte <\/span>pe<\/span>riodice\n<\/span>pentru <\/span>a <\/span>oferi\n<\/span>vizibilitate <\/span>asupra <\/span>st\u0103rii\n<\/span>vulnerabilit\u0103\u021bilor<\/span>,\nresponsabilit\u0103\u021bilor <\/span>atribuite <\/span>\u0219i <\/span>progresului <\/span>remediilor<\/span>.\nAceste <\/span>rapoarte <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>sprijine\ntransparen\u021ba \u0219i supravegherea managementului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Facilitarea mon<\/span>itoriz\u0103rii\ncontinue prin automatizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>instituite  <\/span><\/span>mecanisme\n <\/span><\/span>automatizate\n <\/span><\/span>pentru\n <\/span><\/span>monitorizarea\n <\/span><\/span>continu\u0103\n <\/span><\/span>a\n <\/span><\/span>noilor\nvulnerabilit\u0103\u021bi \u0219i pentru asigurarea actualiz\u0103rii corespunz\u0103toare a flux<\/span>urilor de lucru de remediere.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea eficacit\u0103\u021bii automatiz\u0103<\/span>rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Eficacitatea <\/span>automatiz\u0103rii <\/span>ar <\/span>trebui <\/span>evaluat\u0103\n<\/span>periodic <\/span>pentru <\/span>determinarea <\/span>\u00eembun\u0103t\u0103\u021birilor <\/span>\u00een\nceea <\/span>ce <\/span>priv<\/span>e\u0219te <\/span>timpul <\/span>de <\/span>r\u0103spuns,\n<\/span>eficien\u021ba <\/span>\u0219i gradul <\/span>de <\/span>con\u0219tientizare <\/span>al <\/span>p\u0103r\u021bilor <\/span>interesate. Dac\u0103 obiectivele nu sunt\n\u00eendeplinite, <\/span>ar trebui efectuate aj<\/span>ust\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea acoperirii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesul  <\/span><\/span>de  <\/span><\/span>automatizare  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>includ\u0103\n <\/span><\/span>mediile\n <\/span><\/span>O<\/span>T<\/span>,\n <\/span><\/span>abord\u00e2nd\n <\/span><\/span>sistemele\n <\/span><\/span>vechi,\ncomponentele <\/span>gestionate <\/span>de <\/span>v\u00e2nz\u0103tori <\/span>\u0219i <\/span>firmwa<\/span>re-ul <\/span>integrat. <\/span>Pentru <\/span>remedierea <\/span>probl<\/span>emelor\ndin aceste medii poate fi necesar\u0103 coordonarea cu echipele de ingineri.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[ID.IM]\n\u00ceMBUN\u0102T\u0102\u021aIRE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cembun\u0103t\u0103\u021birile  <\/span><\/span>aduse\n <\/span><\/span>proceselor,\n <\/span><\/span>procedurilor\n <\/span><\/span>\u0219i\n <\/span><\/span>activit\u0103\u021bilor\n <\/span><\/span>organiza\u021bionale\n <\/span><\/span>de\n <\/span><\/span>management\n <\/span><\/span>al\nriscului de securitate cibernetic\u0103 sunt identificate \u00een toate func\u021biile CyFun\u00ae.<\/span><\/p>\n\n

ID.IM-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cembun\u0103t\u0103\u021birile <\/span>sunt <\/span>identificate <\/span>pe <\/span>baza <\/span>testelor\n<\/span>\u0219i <\/span>exerci\u021biilor <\/span>de <\/span>securitate, <\/span>inclusiv\n<\/span>a <\/span>celor <\/span>efectuate \u00een coordonare cu furnizorii \u0219i p\u0103r\u021bile ter\u021be\nrelevante.<\/span><\/p>\n\n

ID.IM-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Testele <\/span>\u0219i <\/span>exerci\u021biile <\/span>de <\/span>securitate, <\/span>inclusiv\n<\/span>cele <\/span>efectuate <\/span>\u00eempreun\u0103\n<\/span>cu <\/span>furnizo<\/span>rii <\/span>\u0219i <\/span>p\u0103r\u021bile\n<\/span>ter\u021be relevante, trebuie utilizate pentru identificarea domeniilor care\nnecesit\u0103 \u00eembun\u0103t\u0103\u021biri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>identifica <\/span>oportunit\u0103\u021bi <\/span>de <\/span>\u00eembun\u0103t\u0103\u021bire <\/span>a <\/span>securit\u0103\u021bii, <\/span>a <\/span>r\u0103spunsului\nla <\/span>incidente <\/span>\u0219i <\/span>a <\/span>rezilien\u021b<\/span>ei <\/span>prin <\/span>efectuarea <\/span>de <\/span>teste <\/span>\u0219i <\/span>exerci\u021bii <\/span>de <\/span>securitate <\/span>– <\/span>at\u00e2t <\/span>la <\/span>nivel <\/span>intern,\n<\/span>c\u00e2t <\/span>\u0219i \u00een colaborare cu\nfurnizorii \u0219i p\u0103r\u021bile ter\u021be. \u00cen mediile OT, aceste activit\u0103\u021bi sunt esen\u021biale\npentru asigurarea <\/span>preg\u0103tirii <\/span>pentru <\/span>incidente <\/span>care <\/span>ar <\/span>putea afecta <\/span>o<\/span>pera\u021biunile <\/span>fizice,\n<\/span>siguran\u021ba <\/span>sau continuitatea\nserviciilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea gradului de preg\u0103tire pentru r\u0103spunsul la\nincidente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>este <\/span>de <\/span>securitate, <\/span>precum <\/span>exerci\u021bii <\/span>teoretice, <\/span>simul\u0103ri, <\/span>revizuiri <\/span>interne\n<\/span>\u0219i <\/span>audituri, <\/span>ar <\/span>trebui\nutilizate pentru a identifica \u00eembun\u0103t\u0103\u021biri \u00een procedurile de r\u0103s<\/span>puns la incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Coordonarea cu p\u0103r\u021bile externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>se <\/span>or<\/span>ganizeze <\/span>exerci\u021bii <\/span>care <\/span>s\u0103 <\/span>implice\n<\/span>furnizorii <\/span>de <\/span>servicii\n<\/span>critice <\/span>\u0219i <\/span>furnizorii <\/span>de produse pentru a consolida continuitatea activit\u0103\u021bii,\nrecuperarea \u00een caz de dezastru \u0219i capabilit\u0103\u021bile de r\u0103spuns la incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implicarea p\u0103r\u021bilor interesate interne<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Rolurile <\/span>interne <\/span>relevante, <\/span>inclusiv <\/span>membri <\/span>ai <\/span>conducerii <\/span>superioare, <\/span>depar<\/span>tamentul <\/span>juridic\n<\/span>\u0219i resursele umane, ar trebui s\u0103 fie implicate \u00een exerci\u021bii pentru a\nasigura <\/span>con\u0219tientizarea \u0219i alinierea\nor<\/span>ganiza\u021bional\u0103 lar<\/span>g\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Efectuarea de teste de penetrare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele  <\/span><\/span>cu  <\/span><\/span>risc  <\/span><\/span>ridicat  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>supuse\n <\/span><\/span>testelor\n <\/span><\/span>de\n <\/span><\/span>penetrare\n <\/span><\/span>pentru\n <\/span><\/span>ident<\/span>ificarea vulnerabilit\u0103\u021bilor<\/span>. <\/span>Aceste <\/span>teste ar tr<\/span>ebui aprobate \u00een prealabil de conducere.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea planurilor de ur<\/span>gen\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile <\/span>de <\/span>r\u0103spuns <\/span>la <\/span>produse <\/span>sau <\/span>servicii <\/span>neautorizate <\/span>sau <\/span>falsificate <\/span>ar <\/span>trebui <\/span>testate\n<\/span>\u0219i perfec\u021bionate pentru asigurarea unei recuper\u0103ri eficace.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>activit\u0103\u021bile <\/span>de <\/span>testare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>conforme\n<\/span>cu <\/span>procedurile <\/span>interne\n<\/span>\u0219i <\/span>s\u0103 <\/span>respecte <\/span>legile,\nreglement\u0103rile \u0219i standardele din domeniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cembun\u0103t\u0103\u021birile  <\/span> <\/span><\/span>sunt \n<\/span> <\/span><\/span>ident<\/span>ificate  <\/span> <\/span><\/span>\u00een \n<\/span> <\/span><\/span>urma \n<\/span> <\/span><\/span>execut\u0103rii  <\/span> <\/span><\/span>proceselor,  <\/span> <\/span><\/span>procedurilor  <\/span> <\/span><\/span>\u0219i \n<\/span> <\/span><\/span>activit\u0103\u021bilor opera\u021bionale<\/span>.<\/span><\/p>\n\n

ID.IM-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nrealizeze eval<\/span>u\u0103ri post<\/span>-incident pentru analizarea lec\u021biilor\n\u00eenv\u0103\u021bate din activit\u0103\u021bile <\/span>de <\/span>r\u0103spuns <\/span>la <\/span>incidente\n<\/span>\u0219i <\/span>de recuperare <\/span>\u0219i, <\/span>\u00een <\/span>cons<\/span>ecin\u021b\u0103, <\/span>pentru <\/span>\u00eembun\u0103t\u0103\u021birea\nproceselor\/procedurilor\/tehnologiilor \u00een vederea consolid\u0103rii rezilien\u021bei sale\ncibernetice.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>consolida\n<\/span>rezilien\u021ba <\/span>cibernetic\u0103 <\/span>prin <\/span>\u00eenv\u0103\u021barea <\/span>din <\/span>incidente. <\/span>Dup\u0103 fiecare i<\/span>n<\/span>cident, organiza\u021bia\nar trebui s\u0103 analizeze ce s<\/span>-a\n\u00eent\u00e2mplat, modul \u00een care acesta a fost gestionat \u0219i ce poate fi \u00eembun\u0103t\u0103\u021bit la\nnivelul proceselor, procedurilor sau tehnologiilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm<\/span>\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Realizarea <\/span>revizuirilor <\/span>post<\/span>-incident<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>O  <\/span><\/span>evaluare  <\/span><\/span>structurat\u0103  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>realizat\u0103\n <\/span><\/span>dup\u0103\n <\/span><\/span>fiecare\n <\/span><\/span>incident,\n <\/span><\/span>cu\n <\/span><\/span>implicarea\n <\/span><\/span>tuturor\nparticipan\u021bilor relevan\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Reflectarea asupra \u00eentreb\u0103rilor cheie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirea\nar trebui s\u0103 cuprind\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Ce\ns-a \u00eent\u00e2mplat \u0219i de ce.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Cum a\nfost gestionat r\u0103spunsul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Ce a\nfunc\u021bionat bine \u0219i ce nu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Ce\nm\u0103suri ar trebui luate pentru preve<\/span>nirea\nrecuren\u021bei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea lec\u021biilor \u00eenv\u0103\u021bate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Constat\u0103rile  <\/span><\/span>rezultate  <\/span><\/span>\u00een  <\/span><\/span>urma  <\/span><\/span>revizuirii\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>documentate\n <\/span><\/span>\u0219i\n <\/span><\/span>comunicate\n <\/span><\/span>echipel<\/span>or relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualizarea politicilor \u0219i procedurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politicile, <\/span>procesele <\/span>\u0219i <\/span>procedurile <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>\u0219i <\/span>actualizate periodic, cel\npu\u021bin anual, pentru a reflecta lec\u021biile \u00eenv\u0103\u021bate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cembun\u0103t\u0103\u021birea instrumentelor \u0219i capac<\/span>it<\/span>\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acolo  <\/span><\/span>unde  <\/span><\/span>este  <\/span><\/span>cazul,  <\/span><\/span>tehnologiile  <\/span><\/span>\u0219i  <\/span><\/span>instrumentele\n <\/span><\/span>de\n <\/span><\/span>r\u0103spuns\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>adaptate\n <\/span><\/span>sau\nactualizate pe baza informa\u021biilor ob\u021binute \u00een urma incidentului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\n\u00eencorporeze lec\u021biile \u00eenv\u0103\u021bate din activit\u0103\u021bile de <\/span>gestionare a incidentelor \u00een procesele <\/span>\u0219i\/sau <\/span>procedurile <\/span>actualizate <\/span>sau <\/span>noi <\/span>de <\/span>gestionare\na <\/span>incidentelor, <\/span>care <\/span>sunt <\/span>\u00eencadrate\n<\/span>de <\/span>o instruire adecvat\u0103 dup\u0103 revizuire,\naprobare \u0219i testare.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>\u00eembun\u0103t\u0103\u021b<\/span>i <\/span>capabilit\u0103\u021bile <\/span>organiza\u021biei <\/span>de <\/span>gestionare <\/span>a <\/span>incidentelor\nprin \u00eencorporarea lec\u021biilor \u00eenv\u0103\u021bate din incidentele anterioare \u00een procesele \u0219i\nprocedurile actualizate sau <\/span>noi. <\/span>\u00cen <\/span>mediile <\/span>OT, <\/span>unde <\/span>incidentele <\/span>pot <\/span>afecta <\/span>direct <\/span>sistemele <\/span>fizice <\/span>\u0219i <\/span>continuitatea <\/span>opera\u021bional\u0103, aplicarea cuno\u0219tin\u021belor din lumea real\u0103 contribuie\nla consolidarea eficacit\u0103\u021bii r\u0103s<\/span>punsului\n\u0219i la reducerea probabilit\u0103\u021bii de e\u0219ecuri rep<\/span>etate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Acoperirea \u00eentregului ciclu de via\u021b\u0103 al incidentului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Lec\u021biile <\/span>ar <\/span>trebui <\/span>extrase <\/span>din <\/span>toate <\/span>etapele\n<\/span>gestion\u0103rii <\/span>incidentelor<\/span>, <\/span>inclusiv <\/span>identificarea, clasificarea, prioritizarea<\/span>, investigarea, rezolvarea, recuperarea,\n\u00eenchiderea \u0219i revizuire<\/span>a post<\/span>– incident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Demonstrarea optimiz\u0103rii proceselor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualiz\u0103rile  <\/span><\/span>procedurilor  <\/span><\/span>de  <\/span><\/span>gestionare  <\/span><\/span>a  <\/span><\/span>incidentelor\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>reflecte\n <\/span><\/span>informa\u021biile\nob\u021binute din incidentele anterioare \u0219i s\u0103 fie documentate \u00een mod clar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Colaborarea cu furnizori<\/span>i<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sesiunile <\/span>de <\/span>analiz\u0103\n<\/span>a <\/span>lec\u021biilor <\/span>\u00eenv\u0103\u021bate\n<\/span>ar <\/span>t<\/span>rebui <\/span>desf\u0103\u0219urate <\/span>\u00eempreun\u0103\n<\/span>cu <\/span>furnizorii <\/span>cheie pentru \u00eembun\u0103t\u0103\u021birea coordon\u0103rii \u0219i r\u0103spunsului\n\u00een cadrul lan\u021bul<\/span>ui de aprovizionare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea indicatorilor de performan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Indicatorii <\/span>ar <\/span>trebui <\/span>utiliza\u021bi <\/span>pentru <\/span>urm\u0103rirea <\/span>\u0219i <\/span>evaluarea <\/span>eficacit\u0103\u021bii <\/span>gestion\u0103rii <\/span>incidentelor\n\u00een timp \u0219i pentru ghidarea \u00eembun\u0103t\u0103\u021birilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>actualiz\u0103rile <\/span>proce<\/span>selor <\/span>\u0219i <\/span>procedurilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>conforme <\/span>cu <\/span>cerin\u021bele\n<\/span>interne <\/span>de guvernan\u021b\u0103 \u0219i s\u0103\nrespecte legile, reglement\u0103rile \u0219i standardele din dom<\/span>eniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nidentifice \u00eembun\u0103t\u0103\u021biri rezultate din activit\u0103\u021bile de monitorizare, m\u0103surare,\nevaluare \u0219i din lec\u021biile \u00eenv\u0103\u021bate \u0219i s\u0103 le transpun\u0103 \u00een\nprocese\/proceduri\/tehnologi<\/span>i\n\u00eembun\u0103t\u0103\u021bite pentru consolidarea rezilien\u021bei sale cibernetice (\u00eembun\u0103t\u0103\u021bire\ncontinu\u0103).<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nconsolida <\/span>re<\/span>zilien\u021ba <\/span>cibernetic\u0103 <\/span>a <\/span>org<\/span>aniza\u021biei\n<\/span>prin <\/span>identificarea\n\u00eembun\u0103t\u0103\u021birilor rezultate din monitorizare<\/span>,\nm\u0103sur\u0103tori, evalu\u0103ri \u0219i lec\u021bii \u00eenv\u0103\u021bate \u0219i transpunerea acestora \u00een procese,\nproceduri sau tehnologii actualizate. \u00cen mediile OT, \u00een care fiabilitatea \u0219i\nsiguran\u021ba sistemului sunt str\u00e2ns legate de performan\u021ba cibernetic\u0103,\n\u00eembun\u0103t\u0103\u021birea continu\u0103 ajut\u0103 la men\u021binerea integrit\u0103\u021bii opera\u021bionale \u0219i la\nadaptarea la amenin\u021b\u0103rile \u00een continu\u0103 evolu\u021bie.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea indicatorilor de rezilien\u021b\u0103 cibernetic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Indicatorii <\/span>ar <\/span>trebui\n<\/span>utiliza\u021bi <\/span>pentru <\/span>evaluarea\n<\/span>capacit\u0103\u021bii <\/span>or<\/span>ganiza\u021biei <\/span>de <\/span>a <\/span>rezista\n<\/span>\u0219i <\/span>de <\/span>a <\/span>se recupera \u00een\nurma incidentelor cibernetice, sprijinind managementul riscului \u0219i luarea\ndeciziilor informate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea m\u0103surilor de eficacitate (MOE)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>MOE <\/span>ar <\/span>trebui <\/span>utilizate <\/span>pentru <\/span>evaluare<\/span>a <\/span>\u0219i <\/span>compararea <\/span>eficacit\u0103\u021bii <\/span>diferitelor <\/span>strategii\n<\/span>de rezilien\u021b\u0103 cibernetic\u0103 \u0219i pentru ghidarea deciziilor de investi\u021bii\nsau proiectare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea indicatorilor orienta\u021bi c\u0103tre obiective<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Indicatorii <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>acopere <\/span>preg\u0103tirea, <\/span>continuitatea <\/span>opera\u021bional\u0103 <\/span>\u00een <\/span>timpul <\/span>atacurilor<\/span>, limitarea daunelor \u0219i capabilit\u0103\u021bile de recuperare \u0219i\nrestaurare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Efectuarea de evalu\u0103ri independente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Echipe <\/span>independente <\/span>ar trebui\n<\/span>angajate <\/span>pentru <\/span>efectuarea <\/span>de evalu\u0103ri <\/span>\u0219i <\/span>oferirea\n<\/span>de <\/span>informa\u021bii obiective cu\nprivire la do<\/span>meniile care necesit\u0103\n\u00eembun\u0103t\u0103\u021biri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea sistemelor de notare structurate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>luate <\/span>\u00een <\/span>considerare <\/span>metodologii <\/span>de <\/span>notar<\/span>e, <\/span>precum <\/span>Situated <\/span>Scoring <\/span>Methodology\nfor <\/span>Cyber <\/span>Resiliency (SSM-CR) <\/span>elaborat <\/span>de <\/span>c\u0103tre <\/span>MITRE, <\/span>pentru <\/span>a <\/span>spriji<\/span>ni <\/span>evaluarea\nstructurat\u0103 \u0219i prioritizarea \u00eembun\u0103t\u0103\u021birilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>\u00eembun\u0103t\u0103\u021birile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>aliniate\n<\/span>cu <\/span>cerin\u021bele <\/span>interne\n<\/span>de <\/span>guvernan\u021b\u0103 <\/span>\u0219i <\/span>s\u0103 <\/span>respecte legile, reglement\u0103rile \u0219i\nstandardele <\/span>din domeniu a<\/span>plicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>colaboreze <\/span>\u0219i <\/span>partajeze <\/span>informa\u021bii <\/span>despre <\/span>incidentele <\/span>de <\/span>securitate <\/span>legate\n<\/span>de sistemele sale critice \u0219i m\u0103surile de atenuare cu partenerii\ndesemna\u021bi.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>co<\/span>nsolida\n<\/span>rezilien\u021ba <\/span>cibernetic\u0103 <\/span>prin schimbul <\/span>de <\/span>informa\u021bii <\/span>cu partenerii <\/span>desemna\u021bi <\/span>cu <\/span>privire\n<\/span>la <\/span>incidentele <\/span>de <\/span>securitate <\/span>\u0219i <\/span>m\u0103surile <\/span>de <\/span>atenuare <\/span>legate <\/span>de <\/span>sistemele critice. <\/span>\u00cen mediile <\/span>OT, <\/span>schimbul <\/span>de <\/span>informa\u021bii\n<\/span>coordonat <\/span>\u0219i <\/span>\u00een <\/span>timp <\/span>util <\/span>contribuie <\/span>la <\/span>pr<\/span>evenirea r\u0103sp\u00e2ndirii <\/span>amenin\u021b\u0103rilor, <\/span>sprijin\u0103 <\/span>rec<\/span>uperarea <\/span>mai <\/span>rapid\u0103 <\/span>\u0219i <\/span>\u00eembun\u0103t\u0103\u021be\u0219te <\/span>ap\u0103rarea\n<\/span>colectiv\u0103 <\/span>\u00een <\/span>cadrul sistemelor interconectate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea rolurilor \u0219i atribu\u021biilor de autoritate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>IRP-ul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>descrie\n<\/span>\u00een <\/span>mod <\/span>clar <\/span>rolurile, <\/span>responsabilit\u0103\u021bile <\/span>\u0219i <\/span>autoriza\u021biile <\/span>pentru partajarea informa\u021biilor legate de incidente\ncu partenerii desemna\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea echipei de r\u0103spuns<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Personalul <\/span>de <\/span>r\u0103spuns\n<\/span>la <\/span>incidente <\/span>a<\/span>r <\/span>trebui\n<\/span>instruit <\/span>periodic <\/span>cu <\/span>privire <\/span>la <\/span>proced<\/span>urile\n<\/span>de comunicare cu partenerii externi \u00een timpul \u0219i dup<\/span>\u0103 incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Coordonarea cu partenerii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Schimbul <\/span>de <\/span>informa\u021bii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>detalii\n<\/span>despre <\/span>incidente, <\/span>m\u0103suri\n<\/span>de <\/span>atenuare <\/span>\u0219i <\/span>lec\u021bii\n\u00eenv\u0103\u021bate, \u00een special cu furnizorii \u0219i prestatorii de servicii im<\/span>plica\u021bi \u00een opera\u021biunile critice ale\nsistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Consultarea <\/span>recomand\u0103rilor <\/span>de <\/span>\u00eencredere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Practicile <\/span>relevante\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>se <\/span>bazeze <\/span>pe <\/span>surse <\/span>de <\/span>\u00eencredere,\n<\/span>precum <\/span>Ghidul <\/span>de <\/span>securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

22-001 <\/span>elab<\/span>orat <\/span>de <\/span>c\u0103t<\/span>re <\/span>ENISA\/CER<\/span>T<\/span>-EU, <\/span>care <\/span>furnizeaz\u0103 <\/span>m\u0103suri <\/span>reco<\/span>mandate\n<\/span>de <\/span>atenuare a amenin\u021b\u0103rilor\ncritice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate activit\u0103\u021bile de cola<\/span>borare\n\u0219i <\/span>partajare ar trebui s\u0103 fie\nconforme cu politicile interne \u0219i s\u0103 respecte legile, reglemen<\/span>t\u0103rile \u0219i standardele din domeniu\naplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Comunicare<\/span>a\neficacit\u0103\u021bii tehnologiilor de protec\u021bie trebuie \u00eemp\u0103rt\u0103\u0219it\u0103 p\u0103r\u021bilor interesate\nrelevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>eficacitatea <\/span>tehno<\/span>logiilor <\/span>de <\/span>protec\u021bie <\/span>este <\/span>comunicat\u0103\n\u00een mod clar p\u0103r\u021bilor interesate relevante. \u00cen mediile OT, \u00een care instrumentele\nde protec\u021bie asigur\u0103 securitatea sistemelor <\/span>fizice\ncritice, o comunicare eficace sprijin\u0103 luarea de decizii \u00een cuno\u0219tin\u021b\u0103 de\ncauz\u0103, con\u0219tientizarea riscurilor \u0219i alinierea \u00eentre echipele tehnice \u0219i non<\/span>-tehnice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Adaptarea comunic\u0103rii cu p\u0103r\u021bile interesate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Informa\u021biile <\/span>ar <\/span>trebui\n<\/span>adaptate <\/span>la <\/span>nevoile\n<\/span>diferitelor <\/span>categorii <\/span>de <\/span>public; <\/span>echipele\n<\/span>tehnice <\/span>ar putea avea nevoie\nde jurnale <\/span>detaliate, \u00een timp ce\nconducerea executiv\u0103 ar putea avea nevoie de rezumate la nivel \u00eenalt legate de\nriscurile or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dep\u0103\u0219irea indicatorilor tehnici<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunicare<\/span>a <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>nu <\/span>numai <\/span>date <\/span>(de <\/span>exemplu, <\/span>amenin\u021b\u0103ri <\/span>blocate, <\/span>incidente\ndetectate), <\/span>ci <\/span>\u0219i <\/span>informa\u021bii <\/span>despre <\/span>postura <\/span>de <\/span>risc, <\/span>te<\/span>ndin\u021bele <\/span>emer<\/span>gente\n\u0219i <\/span>m\u0103surile recomandate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea tuturor rolurilor relevante<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>P\u0103r\u021bile <\/span>interesate, <\/span>precum <\/span>CISO, <\/span>echipele\n<\/span>de <\/span>securita<\/span>te <\/span>IT<\/span>, <\/span>responsabilii <\/span>cu <\/span>conformitatea,\nauditorii interni \u0219i conducerea executiv\u0103, ar trebui s\u0103 primeasc\u0103 informa\u021biile\nnecesare pentru \u00eendeplinirea <\/span>responsabilit\u0103\u021bilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i raportarea performan\u021bei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Performan\u021ba  <\/span><\/span>tehnologiilor  <\/span><\/span>de  <\/span><\/span>protec\u021bie  <\/span><\/span>(de  <\/span><\/span>exem<\/span>plu,  <\/span><\/span>antivirus,  <\/span><\/span>firewall<\/span>-uri,  <\/span><\/span>preven\u021bia intruziunilor<\/span>, detec\u021bia endpoint<\/span>-urilor<\/span>, prevenirea\npierderii datelor <\/span>– DLP) ar trebui\nmonitorizat\u0103 \u0219i raportat\u0103 \u00een mod continuu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea \u00eembun\u0103t\u0103\u021birii continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunicare<\/span>a  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>contribuie\n <\/span><\/span>la\n <\/span><\/span>identificare<\/span>a  <\/span><\/span>lac<\/span>unelor<\/span>,  <\/span><\/span>la  <\/span><\/span>informarea  <\/span><\/span>deciziilor strategice \u0219i\nla promovarea unei culturi a transparen\u021bei \u0219i a rezilien\u021bei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>practicile <\/span>de <\/span>comunicare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>aliniate\n<\/span>cu <\/span>politicile <\/span>interne\n<\/span>\u0219i <\/span>s\u0103 <\/span>respecte <\/span>legile,\nreglement\u0103rile \u0219i standardele din domeniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.6<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia  <\/span><\/span>trebuie  <\/span><\/span>s\u0103  <\/span><\/span>im<\/span>plementeze,  <\/span><\/span>acolo  <\/span><\/span>unde\n <\/span><\/span>este\n <\/span><\/span>fezabil,\n <\/span><\/span>mecanisme\n <\/span><\/span>automatizate\n <\/span><\/span>pentru\nfacilitarea procesului de schimb de informa\u021bii \u0219i colaborare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a \u00eembun\u0103t\u0103\u021bi eficien\u021ba, acurate\u021bea \u0219i securitatea schimbului de\ninforma\u021bii <\/span>\u0219i <\/span>a <\/span>colabor\u0103ri<\/span>i <\/span>prin <\/span>implementarea <\/span>de <\/span>mecanisme <\/span>automatizate <\/span>acolo <\/span>unde <\/span>este <\/span>fezabil. <\/span>\u00cen mediile OT, automatizarea contribuie la\nreduc<\/span>erea ero<\/span>rilor manuale, la punerea \u00een aplicare a controalelor de acces \u0219i\nla spr<\/span>ijinirea lu\u0103rii de decizii \u00een\ntimp util \u00een cadrul sistemelor interconectate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Corelarea autoriza\u021biilor <\/span>de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>automatizate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>verifice <\/span>dac\u0103 <\/span>drepturile <\/span>de <\/span>acces <\/span>ale <\/span>partenerilor <\/span>care partajeaz\u0103 informa\u021bii sunt aliniate\ncu nivelul de sensibilitate a informa\u021biilor<\/span>.\nNeconcordan\u021bele ar trebui se<\/span>mnalate\n\u00eenainte de partajare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea punerii \u00een aplicare a politicilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>evalueze <\/span>automat <\/span>dac\u0103 <\/span>informa\u021biile <\/span>pot <\/span>fi <\/span>partajate\n<\/span>pe <\/span>baza <\/span>clasific\u0103rii acestora <\/span>\u0219i <\/span>a <\/span>drepturilor <\/span>de <\/span>acces <\/span>ale <\/span>dest<\/span>inatarului. Aceste <\/span>verific\u0103ri <\/span>ar <\/span>trebui <\/span>integrate <\/span>cu sistemele <\/span>de <\/span>managementul <\/span>identit\u0103\u021bii <\/span>\u0219i <\/span>accesului <\/span>(IAM) <\/span>pentru <\/span>a <\/span>asigura <\/span>actualizarea <\/span>datelor de autorizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controlul c\u0103ut\u0103rii \u0219i recuper\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>de <\/span>c\u0103utare\n<\/span>\u0219i <\/span>recuperare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>pun\u0103 <\/span>\u00een <\/span>aplicare <\/span>restric\u021bii <\/span>de <\/span>acces <\/span>utiliz\u00e2nd etichetarea \u0219i clasificarea\nmetadatelor<\/span>, <\/span>asigur\u00e2ndu-se c\u0103 utilizatorii pot accesa numai informa\u021biile <\/span>autorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Activit\u0103\u021bi de monitorizare \u0219i audit<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnalizarea <\/span>\u0219i <\/span>monitorizarea <\/span>automat\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>urm\u0103reasc\u0103 <\/span>toate <\/span>ac\u021biunile <\/span>de <\/span>schimb <\/span>de informa\u021bii. Jurnalele ar trebui reviz<\/span>uite periodic pent<\/span>ru detec\u021bia accesului neautorizat sau \u00eenc\u0103lc\u0103rile politicii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Promovarea utilizabilit\u0103\u021bii \u0219i a instruirii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele automate ar trebui s\u0103 fie u\u0219or de utilizat\npentru a \u00eencuraja utilizarea corect\u0103. <\/span>Ar\ntrebui furnizat\u0103 instruire pentru ca utilizatorii s\u0103 <\/span>\u00een\u021beleag\u0103 cum s\u0103 foloseasc\u0103 aceste instrumente \u00een mod eficace \u0219i\nresponsabil.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea conformit\u0103\u021bii \u0219i respect\u0103rii normelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>mecanismele <\/span>automatizate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fi<\/span>e <\/span>ali<\/span>niate <\/span>cu <\/span>politicile <\/span>interne <\/span>\u0219i <\/span>s\u0103 <\/span>respecte\nlegile, reglement\u0103rile \u0219i standarde<\/span>le\ndin domeniu aplicabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.7<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>implementeze <\/span>echipe <\/span>independente <\/span>pentru <\/span>evaluarea <\/span>proceselor\n<\/span>sale, <\/span>cele <\/span>mai bune practici \u0219i solu\u021biile tehnologice\npentru protejarea si<\/span>stemelor \u0219i activelor\ncritice.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nconsolida protec\u021bia sistemelor \u0219i activelor crit<\/span>ice prin asigurarea unor evalu\u0103ri obiective ale proceselor,\npracticilor \u0219i tehnologiilor organiza\u021biei. \u00cen mediile OT, evalu\u0103rile independente\ncontribuie la identificarea v<\/span>ulnerabilit\u0103\u021bilor,\nla reducerea prejudec\u0103\u021bilor \u0219i la sus\u021binerea\n<\/span>\u00eembun\u0103t\u0103\u021birii <\/span>continue <\/span>a <\/span>rezilien\u021bei <\/span>\u0219i <\/span>siguran\u021bei <\/span>sistemului.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implicarea echipelor independente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluatorii  <\/span><\/span>independen\u021bi  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>includ\u0103\n <\/span><\/span>personal\n <\/span><\/span>intern\n <\/span><\/span>care\n <\/span><\/span>nu\n <\/span><\/span>este\n <\/span><\/span>implicat\n <\/span><\/span>\u00een\ndezvoltarea sau func\u021bionarea sistemului \u0219i exper\u021bi externi care nu au leg\u0103<\/span>turi financiare sau opera\u021bionale <\/span>cu sistemul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea impar\u021bialit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluatorii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>liberi <\/span>de <\/span>conflicte <\/span>de <\/span>interese. <\/span>Rolurile <\/span>de <\/span>evaluare\n<\/span>ar <\/span>trebui <\/span>rotite pentru evitarea prejudec\u0103\u021bilor\nlegate de familiaritate. Independen\u021ba \u0219i calific\u0103rile ar tr<\/span>ebui s\u0103 fie documentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea clar\u0103 a domeniului de aplicare \u0219i a\ncriteriilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Obiectivele, <\/span>domeniul <\/span>de <\/span>aplicare <\/span>\u0219i <\/span>criteriile <\/span>de <\/span>evaluare <\/span>ar <\/span>trebui <\/span>convenite <\/span>\u00een <\/span>prealabil pentru\na preveni influen\u021ba nejustificat\u0103 din partea p\u0103r\u021bilor interesate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea liniilor de rap<\/span>ortare independente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Rezultatele <\/span>evalu\u0103rii <\/span>ar <\/span>trebui <\/span>raport<\/span>ate <\/span>direct <\/span>conducerii <\/span>superioare\n<\/span>a <\/span>or<\/span>ganiza\u021biei <\/span>sau <\/span>unui or<\/span>ganism\nde supraveghere, ocolind echipele responsabile de <\/span>sistemele revizuite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea p<\/span>eriodic\u0103\na eficacit\u0103\u021bii evalu\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Independen\u021ba  <\/span><\/span>\u0219i  <\/span><\/span>performan\u021ba  <\/span><\/span>echipelor  <\/span><\/span>de  <\/span><\/span>evaluare\n <\/span><\/span>ar\n <\/span><\/span>tr<\/span>ebui  <\/span><\/span>revizuite  <\/span><\/span>periodic  <\/span><\/span>pentr<\/span>u men\u021binerea <\/span>obiectivit\u0103\u021bii \u0219i relevan\u021bei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.8<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>se <\/span>asigure <\/span>c\u0103 <\/span>planul <\/span>de <\/span>securitate <\/span>pentru\n<\/span>sistemele <\/span>sale <\/span>critice\n<\/span>faciliteaz\u0103 revizuirea, testarea \u0219i \u00eembun\u0103t\u0103\u021birea continu\u0103 a proceselor\nde protec\u021bie a securit\u0103\u021bii.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 planul de securitate al organiza\u021biei pentru\nsistemele critice <\/span>sprijin\u0103 <\/span>revizuirea\n<\/span>periodic\u0103, testarea <\/span>\u0219i <\/span>\u00eembun\u0103t\u0103\u021birea <\/span>continu\u0103 <\/span>a <\/span>m\u0103surilor\n<\/span>de <\/span>protec\u021bie. <\/span>\u00cen mediile OT, aceasta contribuie <\/span>la men\u021biner<\/span>ea\nintegrit\u0103\u021bii sistemelor, la adaptarea la amenin\u021b\u0103rile \u00een continu\u0103 evolu\u021bie \u0219i la\nalinierea cu eforturile mai ample de management al riscului.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Elaborarea \u0219i men\u021binerea unui plan de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un <\/span>plan <\/span>documentat <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>descrie <\/span>modul\n<\/span>\u00een <\/span>care <\/span>sistemele <\/span>critice <\/span>sunt <\/span>protejate \u00eempotriva <\/span>amenin\u021b\u0103rilor <\/span>la <\/span>adresa <\/span>securit\u0103\u021bii. <\/span>Ac<\/span>esta <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>distinct\n<\/span>de <\/span>planul <\/span>de <\/span>tratare\na riscurilor<\/span>, dar aliniat cu acesta.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Concentrarea pe controale opera\u021bionale \u0219i tehnice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>includ\u0103  <\/span><\/span>obiective\n <\/span><\/span>de\n <\/span><\/span>securitate\n <\/span><\/span>definite,\n <\/span><\/span>responsabilit\u0103\u021bi\n <\/span><\/span>atribuite,\narhitectura de securitate, m\u0103suri de co<\/span>ntrol\n\u0219i proceduri de monitorizare, testare \u0219i revizuire a controalelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Facilitarea revizuirii \u0219i test\u0103rii periodice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>sprijine <\/span>revizuirile <\/span>programate, <\/span>evalu\u0103rile <\/span>vulnerabilit\u0103\u021bilor <\/span>\u0219i <\/span>testele <\/span>de penetrare pentru evaluarea\neficacit\u0103\u021bii m\u0103surilor de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea \u00eembun\u0103t\u0103\u021birii continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualiz\u0103rile <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>se <\/span>bazeze <\/span>pe <\/span>lec\u021biile\n<\/span>\u00eenv\u0103\u021bate, <\/span>informa\u021biile <\/span>privind\n<\/span>amenin\u021b\u0103rile, rezultatele auditurilor \u0219i modific\u0103ri<\/span>le <\/span>\u00een\npeisajul amenin\u021b\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu managementul riscului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul  <\/span><\/span>ar  <\/span><\/span>tr<\/span>ebui\n <\/span><\/span>s\u0103\n <\/span><\/span>fie\n <\/span><\/span>aliniat\n <\/span><\/span>cu\n <\/span><\/span>procesele\n <\/span><\/span>de\n <\/span><\/span>tratare\n <\/span><\/span>a\n <\/span><\/span>riscurilor\n <\/span><\/span>\u0219i\n <\/span><\/span>de\n <\/span><\/span>guvernan\u021b\u0103\n <\/span><\/span>ale\nor<\/span>ganiza\u021biei, pentru asigurarea coere<\/span>n\u021bei \u0219i r\u0103spunderii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea planului actualizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul <\/span>ar <\/span>trebui <\/span>revizuit <\/span>\u0219i <\/span>actualizat <\/span>periodic <\/span>pentru <\/span>a <\/span>reflecta <\/span>modific\u0103rile <\/span>sistemului, <\/span>noile\namenin\u021b\u0103ri \u0219i evolu\u021bia nevoilor opera\u021bionale.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-03.9<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>efectueze\n<\/span>evalu\u0103ri <\/span>specializate, <\/span>inclusiv\n<\/span>monitorizare <\/span>aprofundat\u0103, <\/span>scanare\n<\/span>a vulnerabilit\u0103\u021bilor, testare a utilizatorilor r\u0103u inten\u021biona\u021bi,\nevaluare a amenin\u021b\u0103rilor din interior, testare a performan\u021bei\/\u00eenc\u0103rc\u0103rii \u0219i\ntestare de verificare \u0219i vali<\/span>dare a\nsistemelor critice ale organiza\u021biei. GHID\nDE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>consolida <\/span>securitatea <\/span>sistemelor <\/span>critice\n<\/span>prin <\/span>efectua<\/span>rea <\/span>de <\/span>evalu\u0103ri specializate <\/span>care <\/span>descoper\u0103 <\/span>vulnerabilit\u0103\u021bile, <\/span>evalueaz\u0103 <\/span>perf<\/span>orman\u021ba\n<\/span>\u0219i <\/span>testeaz\u0103 m\u0103suri<\/span>le <\/span>de <\/span>ap\u0103rare \u00eempotriva amenin\u021b\u0103rilor interne \u0219i\nexterne. \u00cen mediile OT, aceste evalu\u0103ri contribuie la validarea protec\u021biilor \u0219<\/span>i sus\u021bin \u00eembun\u0103t\u0103\u021birea continu\u0103.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare <\/span>urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Efectuarea de evalu\u0103ri specializate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\n<\/span>monitorizare <\/span>aprofundat\u0103, <\/span>scanarea\n<\/span>vulnerabilit\u0103\u021bilor<\/span>, <\/span>testarea utilizatorilor          <\/span>r\u0103u   \n<\/span> <\/span><\/span>inten\u021biona\u021bi,    <\/span> <\/span><\/span>evaluarea    <\/span> <\/span><\/span>amenin\u021b\u0103rilor    <\/span> <\/span><\/span>din   \n<\/span> <\/span><\/span>interior<\/span>,    <\/span> <\/span><\/span>testarea\nperforman\u021bei\/\u00eenc\u0103rc\u0103rii \u0219i testarea de verificare \u0219i validare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Externalizarea c\u0103tre furnizori acredita\u021bi<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103rile <\/span>specializate <\/span>ar <\/span>putea <\/span>fi <\/span>externalizate, <\/span>de <\/span>preferin\u021b\u0103 <\/span>c\u0103tre\n<\/span>or<\/span>ganiza\u021bii <\/span>acreditate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acreditarea\nar trebui s\u0103 respecte standarde recunoscute, precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>CREST <\/span>pentru testarea de penetrare \u0219i evaluarea\nvulnerabilit\u0103\u021bilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>ISO\/IEC\n17025 pentru l<\/span>aboratoarele de\ntestare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acreditarea <\/span>ar <\/span>trebui\n<\/span>acordat\u0103 <\/span>de <\/span>or<\/span>ganisme <\/span>recunoscute, <\/span>precum <\/span>CREST<\/span>, <\/span>autorit\u0103\u021bi <\/span>na\u021bionale de <\/span>acreditare <\/span>(de <\/span>exemplu,\n<\/span>Or<\/span>ganismul <\/span>de Acreditare <\/span>Belgian <\/span>– <\/span>BELAC) <\/span>sau <\/span>or<\/span>ganisme\nspecifice  <\/span>in<\/span>dustriei  <\/span>(de  <\/span>exemplu, \n<\/span>PCI  <\/span>Security  <\/span>Standards \n<\/span>Council). <\/span>Aceasta  <\/span>garanteaz\u0103 efectuarea evalu\u0103rilor cu\ncompeten\u021b\u0103 tehnic<\/span>\u0103, impar\u021bialitate\n\u0219i \u00een conformitate cu bunele practici.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea constat\u0103rilor \u00een procesul de remediere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>ulnerabilit\u0103\u021bile <\/span>identificate <\/span>\u00een <\/span>timpul <\/span>evalu\u0103rilor <\/span>ar <\/span>trebui <\/span>abordate\n<\/span>prin <\/span>procese <\/span>de <\/span>remediere\nstabilite, astfel cum este prev\u0103zut \u00een Controlul ID.IM<\/span>-03.3.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea evalu\u0103rii gradului de preg\u0103tire \u0219i\nmaturitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Rezultatele <\/span>evalu\u0103rii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>informeze <\/span>d<\/span>espre <\/span>nivelul\n<\/span>de <\/span>preg\u0103tire <\/span>\u0219i <\/span>performan\u021b\u0103 <\/span>al or<\/span>ganiza\u021biei\n(de exemplu, maturitatea CyFun\u00ae), ghid\u00e2nd \u00eembun\u0103t\u0103\u021birile vizate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

IRP-urile  <\/span><\/span>\u0219i  <\/span><\/span>alte  <\/span><\/span>planuri\n <\/span><\/span>de\n <\/span><\/span>securitate\n <\/span><\/span>cibernetic\u0103\n <\/span><\/span>care\n <\/span><\/span>afecteaz\u0103\n <\/span><\/span>opera\u021biunile\n <\/span><\/span>sunt\n <\/span><\/span>stabilite,\ncomunicate, <\/span>men\u021binute <\/span>\u0219i <\/span>\u00ee<\/span>mbun\u0103t\u0103\u021bite.<\/span><\/p>\n\n

ID.IM-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Planurile <\/span>de <\/span>urgen\u021b\u0103 <\/span>\u0219i <\/span>continuitate <\/span>trebuie\n<\/span>sta<\/span>bilite, <\/span>comunicate, <\/span>men\u021binute, <\/span>testate, <\/span>validate\n<\/span>\u0219i \u00eembun\u0103t\u0103\u021bite.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nasigura <\/span>rezilien\u021ba <\/span>organiza\u021bional\u0103 <\/span>prin <\/span>stabilirea,\nmen\u021biner<\/span>ea \u0219i \u00eembun\u0103t\u0103\u021birea planurilor\nde urgen\u021b\u0103 \u0219i continuitate care permit un r\u0103spuns eficace \u0219i recuperarea \u00een\nurma <\/span>\u00eentreruperilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unor planuri cuprinz\u0103toare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile\nar trebui s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>IRP<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Plan\nde continuitate a activit\u0103\u021bii (BCP).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Plan\nde recu<\/span>perare \u00een caz <\/span>de dezastru (DRP).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acestea <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>abordeze\n<\/span>\u00eentreruperile <\/span>opera\u021bionale, <\/span>\u00eenc\u0103lc\u0103rile <\/span>securit\u0103\u021bii <\/span>datelor <\/span>\u0219i defec\u021biunile critice pent<\/span>ru misiune.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea con\u021binutului clar al planului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile\nar trebui s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Detalii\nde contact \u0219i comunicare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Roluri,\nresp<\/span>onsabilit\u0103\u021bi \u0219i atribu\u021bii de\nautoritate (\u00een conformitate cu GV<\/span>.R<\/span>R<\/span>-02.1).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Proceduri\npentru scenarii comune.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Criterii\npentru stabilirea priorit\u0103\u021bilor<\/span>, <\/span>escaladarea \u0219i luarea deciziilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>IRP-urile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>acopere\n<\/span>detec\u021bia, <\/span>izolarea, <\/span>r\u0103spunsul\n<\/span>\u0219i <\/span>recuperarea <\/span>\u00een <\/span>urma <\/span>incidentelor cibernetice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Comunicare<\/span>a\n\u0219i instruirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile <\/span>ar <\/span>trebui\n<\/span>comunicate <\/span>\u00eentregului <\/span>person<\/span>al <\/span>re<\/span>levant. <\/span>Ar <\/span>trebui <\/span>stabilit\u0103 <\/span>o <\/span>Echip\u0103 <\/span>de management al crizelor<\/span>, format\u0103 din reprezentan\u021bi ai\ndepartamentelor cheie (de exemplu, IT<\/span>,\njuridic, resurse umane, rela\u021bii publice) \u0219i instruit\u0103 s\u0103 ac\u021bioneze \u00een situa\u021bii\nde criz\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea \u0219i revizuirea planurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>revizuite\n <\/span><\/span>cel\n <\/span><\/span>pu\u021bin\n <\/span><\/span>anual\n <\/span><\/span>sau\n <\/span><\/span>dup\u0103\n <\/span><\/span>modific\u0103ri\n <\/span><\/span>sau\n <\/span><\/span>incidente  <\/span>majore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Actualiz\u0103rile\nar trebui s\u0103 reflecte lec\u021biile \u00eenv\u0103\u021bate \u0219i riscurile \u00een evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea \u0219i validarea periodic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile <\/span>ar <\/span>trebui <\/span>testate <\/span>prin <\/span>scenarii <\/span>realiste.\n<\/span>V<\/span>al<\/span>idarea <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>confirme <\/span>func\u021bionarea\nprocedurilor conform <\/span>a\u0219tept\u0103rilor <\/span>\u0219i <\/span>satisfacerea <\/span>nevoilor\n<\/span>opera\u021bionale. <\/span>Rezultatele <\/span>ar <\/span>trebui\ndocumentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cembun\u0103t\u0103\u021birea continu\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Observa\u021biile <\/span>ob\u021binute\n<\/span>din <\/span>teste, <\/span>incidente <\/span>\u0219i <\/span>revizuiri <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>conduc\u0103 <\/span>la <\/span>\u00eemb<\/span>un\u0103t\u0103\u021biri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cembun\u0103t\u0103\u021birile <\/span>ar <\/span>trebui <\/span>prioritizate <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>ri<\/span>sc <\/span>\u0219i <\/span>impact<\/span>, <\/span>pentru\n<\/span>asigurarea <\/span>continuit\u0103\u021bii\nfunc\u021biilor esen\u021biale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>A <\/span>se vedea: \u0218abloane\nde politici <\/span>disponibile pe <\/span><\/span>www<\/span>.cyfun.eu.<\/span><\/a><\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

ID.IM-04.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>coordoneze <\/span>elaborarea <\/span>\u0219i <\/span>testarea\n<\/span>IRP<\/span>-urilor <\/span>\u0219i <\/span>a <\/span>altor <\/span>planuri <\/span>de <\/span>securitate\ncibernetic\u0103 <\/span>care <\/span>afecteaz\u0103 <\/span>opera\u021biuni<\/span>le, <\/span>\u00eempreun\u0103\n<\/span>cu <\/span>p\u0103r\u021bile <\/span>interesate, <\/span>pentru <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>aceste planuri sunt\naliniate la obiectivele generale ale organ<\/span>iza\u021biei\n\u0219i contribuie la consolidarea rezilien\u021bei. GHID\nDE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nasigura <\/span>c\u0103 <\/span>IRP<\/span>-urile <\/span>\u0219i <\/span>alte <\/span>planuri\n<\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>care afecteaz\u0103 <\/span>opera\u021biunile\nsunt <\/span>ali<\/span>niate <\/span>la <\/span>obiectivele <\/span>organiza\u021biei <\/span>\u0219i <\/span>co<\/span>nsolideaz<\/span>\u0103 rezilien\u021ba <\/span>prin dezvoltarea \u0219i testarea coordonat\u0103 cu p\u0103r\u021bile interesate\nrelevante.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i actualizarea periodic\u0103 a planurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile <\/span>ar <\/span>trebui <\/span>revizuite <\/span>\u0219i <\/span>act<\/span>ualizate\n<\/span>pentru <\/span>a <\/span>reflecta\n<\/span>evolu\u021bia <\/span>amenin\u021b\u0103rilor<\/span>, <\/span>modific\u0103rile\nor<\/span>ganiza\u021bionale \u0219i nevoile opera\u021bionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implicarea timpurie a p\u0103r\u021bilor interesate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>P\u0103r\u021bile interesate, inclusiv echipele interne, furnizorii \u0219i\np\u0103r\u021bile ter\u021be relevante, ar trebui s\u0103 fi<\/span>e\nimplicate \u00eenc\u0103 din faza incipient\u0103 a procesului de planificare, <\/span>pentru asigurarea alinierii \u0219i relevan\u021bei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unei comuni<\/span>c\u0103ri\ncontinue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>P\u0103r\u021bile <\/span>interesate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>informate <\/span>cu <\/span>privire <\/span>la <\/span>progresul <\/span>planului, <\/span>actualiz\u0103ri <\/span>\u0219i\nmodific\u0103ri, pentru men\u021binerea unei \u00een\u021belegeri comune \u0219i o <\/span>stare de preg\u0103tire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Coordonarea activit\u0103\u021bilor de testare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>estarea \n<\/span>planurilor  <\/span>ar  <\/span>trebui \n<\/span>coordonat\u0103  <\/span>\u00eempreun\u0103  <\/span>cu \n<\/span>p\u0103r\u021bile  <\/span>interesate <\/span>pentru \n<\/span>validarea eficacit\u0103\u021bii, clarificarea rolurilor \u0219i co<\/span>nsolidarea capabilit\u0103\u021bilor d<\/span>e r\u0103spuns colaborativ<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PROTEC\u021aIE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

[PR.AA]  <\/span> <\/span><\/span>MANAGEMENTUL  <\/span> <\/span><\/span>IDENTIT\u0102\u021aII,  <\/span> <\/span><\/span>AUTENTIFICAREA  <\/span> <\/span><\/span>\u0218I \n<\/span> <\/span><\/span>CONTROLUL ACCESULUI<\/span><\/b><\/span><\/p>\n\n

Accesul <\/span>la <\/span>activele <\/span>fizice <\/span>\u0219i <\/span>logice <\/span>este <\/span>limitat\n<\/span>la <\/span>utilizatorii, <\/span>serviciile <\/span>\u0219i <\/span>hardware<\/span>-ul <\/span>autorizate <\/span>\u0219i <\/span>este\ngestionat propor\u021bional cu riscul evaluat de acces neautorizat.<\/span><\/p>\n\n

PR.AA-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Identit\u0103\u021bile <\/span>\u0219i <\/span>datele <\/span>de <\/span>acces <\/span>ale <\/span>utilizatorilor, <\/span>serviciilor <\/span>\u0219i <\/span>echipamentelor <\/span>autorizate <\/span>sunt <\/span>gestionat<\/span>e de c\u0103tre organiza\u021bie.<\/span><\/p>\n\n

PR.AA-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Identit\u0103\u021bile  <\/span><\/span>\u0219i  <\/span><\/span>datele  <\/span><\/span>de  <\/span><\/span>acces\n <\/span><\/span>ale\n <\/span><\/span>utilizatorilor,\n <\/span><\/span>serviciilor\n <\/span><\/span>\u0219i\n <\/span><\/span>echipamentel<\/span>or  <\/span><\/span>autorizate  <\/span><\/span>trebuie gestionate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\nc\u0103 <\/span>identit\u0103\u021bile <\/span>\u0219i <\/span>datele <\/span>de <\/span>acces <\/span>ale <\/span>utilizatorilor,\nserviciilor \u0219i echipamentelor autorizate sunt gestionate core<\/span>spunz\u0103tor pentru prevenirea accesului\nneautorizat \u0219i pentru sprijinirea opera\u021biunilor securizate at\u00e2t \u00een mediile TIC,\nc\u00e2t \u0219i \u00een cele OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Cereri de acces \u0219i autorizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>ar <\/span>trebui <\/span>solicitat <\/span>\u00een <\/span>mod <\/span>formal, <\/span>do<\/span>cumentat <\/span>\u0219i <\/span>aprobat <\/span>de <\/span>de\u021bin<\/span>\u0103torii <\/span>sistemului\n<\/span>sau ai datelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile\nde acces ar tr<\/span>ebui s\u0103 respecte\nprincipiul privilegiului minim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Managemen<\/span>tul\nidentit\u0103\u021bii \u0219i a datelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui utilizate conturi individuale de utilizator; ar trebui <\/span>evitat\u0103 partajarea parolelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Parolele\nimplicite ar trebui modificate \u00eenainte de activarea sistemelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile\nne<\/span>utilizate ar trebui dezactivate\nimediat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>de <\/span>administrator <\/span>ar <\/span>trebui <\/span>limitate, <\/span>revizuite <\/span>periodic <\/span>\u0219i <\/span>s\u0103 <\/span>nu <\/span>fie <\/span>utilizate <\/span>pentru sarcini zilnice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Politica privind parolele<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui puse \u00een aplicare reguli stricte privind parolele.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Parolele\nar trebui modifi<\/span>cate periodic sau\nimedi<\/span>at dup\u0103 ce se suspecteaz\u0103\ncompromite<\/span>rea lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>o <\/span>politic\u0103\n<\/span>oficial\u0103 <\/span>privind <\/span>parolele\n<\/span>(a <\/span>se <\/span>v<\/span>edea <\/span>\u0219i: <\/span>Setul <\/span>de <\/span>instrumente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

CyFun\u00ae pe www<\/span>.cyfun.eu).<\/span><\/a><\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile\n\u0219i privilegiile ar trebui atribuite prin intermediul grupurilor de utilizatori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Identitatea dispozitivului \u0219i a hardware<\/span>-ului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare <\/span>dispozitiv <\/span>autorizat\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>un <\/span>identificator <\/span>unic <\/span>(de <\/span>exemplu, <\/span>adresa <\/span>MAC, num\u0103rul de serie).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitivele\nar trebui etichetate fizic pentru a facilita inventarierea \u0219i mentenan\u021ba.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Acces partajat la PLC-uri\/HMI-uri (m\u0103suri specifice\nOT)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dac\u0103 <\/span>conturile <\/span>individuale <\/span>nu <\/span>sunt <\/span>fezabile,\n<\/span>pri<\/span>n<\/span>cipiul <\/span>privilegiului <\/span>minim <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie aplicat <\/span>\u00een <\/span>continuare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizat <\/span>un <\/span>server <\/span>jump <\/span>securiza<\/span>t <\/span>sau <\/span>un <\/span>frontend <\/span>HMI <\/span>pentru <\/span>a <\/span>controla <\/span>accesul, <\/span>a jurnaliza activitatea \u0219i a ad\u0103uga\nniveluri suplimentare de autentificare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Acces securizat la distan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cerin\u021bele\nte<\/span>hnice pentru accesul la distan\u021b\u0103\nar tre<\/span>bui definite \u0219i documentate \u00een\nmod clar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizate <\/span>metode <\/span>securizate, <\/span>precum\n<\/span>VPN-uri, <\/span>protocoale <\/span>criptate\n<\/span>(de <\/span>exemplu, <\/span>shell securizat – S<\/span>SH, securitatea stra<\/span>tului\nde transport – <\/span>TLS) \u0219i MF<\/span>A <\/span>(a\nse vedea \u0219i PR.AA-03.2).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul\nla distan\u021b\u0103 ar tre<\/span>bui monitorizat \u0219i\njurnalizat.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Identit\u0103\u021bile  <\/span><\/span>\u0219i  <\/span><\/span>datele  <\/span><\/span>de  <\/span><\/span>acces\n <\/span><\/span>pentru\n <\/span><\/span>utilizatorii,\n <\/span><\/span>serviciile\n <\/span><\/span>\u0219i\n <\/span><\/span>echipamentele\n <\/span><\/span>autorizate\n <\/span><\/span>trebuie\ngestionate prin mecanisme automatizate, ori de c\u00e2te ori <\/span>este fezabil.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nreduce riscul de utilizare abuziv\u0103 a datelor de acces \u0219i de acces neautorizat <\/span>prin <\/span>automatizarea <\/span>proceselor\n<\/span>de management <\/span>al <\/span>identit\u0103\u021bii <\/span>\u0219i <\/span>al <\/span>datelor <\/span>de <\/span>acces, asigur\u00e2nd consecven\u021ba, <\/span>scalabilitatea \u0219i securitatea \u00een mediile\nIT \u0219i OT.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea managementului datelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizate\n<\/span>sistemele <\/span>au<\/span>tomatizate <\/span>pentru <\/span>emiterea, <\/span>verificarea, <\/span>revocarea <\/span>\u0219i <\/span>auditarea datelor <\/span>de <\/span>acces <\/span>pentru <\/span>uti<\/span>lizatori,\n<\/span>servicii <\/span>\u0219i <\/span>hardware. Aceasta <\/span>reduce <\/span>erorile <\/span>manuale\n<\/span>\u0219i \u00eembun\u0103t\u0103\u021be\u0219te eficien\u021ba opera\u021bional\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea unor mecanisme puternice de\nautentificare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen  <\/span><\/span>conformitate  <\/span><\/span>cu  <\/span><\/span>Con<\/span>trolul  <\/span><\/span>PR.A<\/span>A-03.2,\n <\/span><\/span>MF<\/span>A <\/span>trebuie\n <\/span><\/span>s\u0103\n <\/span><\/span>fie\n <\/span><\/span>obligatorie\n <\/span><\/span>pentru\n <\/span><\/span>toate\nacces\u0103rile <\/span>la <\/span>distan\u021b\u0103 <\/span>ale <\/span>re\u021b<\/span>elelor <\/span>or<\/span>ganiza\u021biei. <\/span>MF<\/span>A <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>utilizeze <\/span>cel <\/span>pu\u021bin <\/span>doi <\/span>factori\nindependen\u021bi:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Cuno\u0219tin\u021be\n(de exemplu, parol\u0103 sau PIN).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Posesie\n(de exemplu, token sau smartphone).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Ineren\u021b\u0103\n(de exemplu, amprent\u0103 digital\u0103 sau recu<\/span>noa\u0219tere\nfacial\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ace\u0219ti <\/span>factori <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>indepe<\/span>nden\u021bi <\/span>pentru <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>compromiterea <\/span>unuia <\/span>dintre <\/span>ei nu afecteaz\u0103 ceilal\u021bi.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea solu\u021biilor criptografice \u0219i bazate pe token<\/span>-uri<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Certificatele  <\/span><\/span>digitale  <\/span><\/span>\u0219i  <\/span><\/span>token<\/span>-urile  <\/span><\/span>de  <\/span><\/span>identitate  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>utilizate\n <\/span><\/span>pentru\n <\/span><\/span>autentificarea\nutilizatorilor<\/span>, <\/span>dispozitivelor <\/span>\u0219i <\/span>serviciilor<\/span>, <\/span>\u00een <\/span>special\n<\/span>\u00een <\/span>mediile <\/span>OT<\/span>, <\/span>unde <\/span>gestionarea <\/span>manual\u0103 a datelor de acces poate fi\nnepractic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea integr\u0103rii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Solu\u021biile IAM ar trebui s\u0103 suporte sistemele <\/span>OT<\/span>,\ninclusiv dispozitivele vechi \u0219i componentele gestionate de v\u00e2nz\u0103tori, cu\n\u00eentreruperi minime ale opera\u021biunilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>cazul <\/span>\u00een <\/span>care <\/span>nu <\/span>sunt <\/span>fezabile\n<\/span>conturile <\/span>individuale <\/span>de <\/span>utilizator <\/span>(de <\/span>exemplu, <\/span>accesul partajat la PLC-uri sau HMI-uri),\naccesul ar trebui s\u0103 fie redirec\u021bionat prin servere jump securizate, <\/span>cu <\/span>jurnalizare <\/span>\u0219i <\/span>straturi <\/span>suplimentare <\/span>de <\/span>autentificare. Acce<\/span>sul <\/span>la <\/span>distan\u021b\u0103\n<\/span>la sistemele <\/span>O<\/span>T <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>utilizeze <\/span>protocoale <\/span>securizate <\/span>(de <\/span>exemplu,\n<\/span>VPN, <\/span>SSH, <\/span>TLS),\n<\/span>s\u0103 <\/span>fie limitat \u00een timp (Just<\/span>-In-T<\/span>ime\n– JI<\/span>T) \u0219i s\u0103 fie monitorizat \u00een\ntotalitate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Datele de acces ale\nsistemului trebuie dezactivate dup\u0103 <\/span>o\nperioad\u0103 specific\u0103 de inactivitate, cu excep\u021bia <\/span>cazului <\/span>\u00een <\/span>care <\/span>aceasta <\/span>ar <\/span>compromite\nfunc\u021bionarea <\/span>\u00een <\/span>condi\u021bii <\/span>de <\/span>siguran\u021b\u0103\n<\/span>a <\/span>proceselor (critice).<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura dezactivarea datelor de acces ale sistem<\/span>ului dup\u0103 o perioad\u0103 definit\u0103 de\ninactivitate, cu excep\u021bia cazului \u00een care aceasta ar compromite func\u021bionarea \u00een\ncondi\u021bii <\/span>de <\/span>siguran\u021b\u0103 <\/span>a <\/span>proceselor <\/span>critice. <\/span>Aceasta <\/span>contribuie <\/span>la <\/span>reducerea <\/span>ri<\/span>scului <\/span>de <\/span>acces <\/span>neautorizat<\/span>, men\u021bin\u00e2nd \u00een acela\u0219i timp continuitatea opera\u021bional\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea conturilor de serviciu pentru opera\u021biuni\nautomatizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>de <\/span>serviciu\n<\/span>ar <\/span>trebui <\/span>utilizate <\/span>pentru <\/span>rularea <\/span>aplica\u021biilor<\/span>, <\/span>serviciilor <\/span>sau <\/span>sa<\/span>rcinilor automatizate. <\/span>Aceste <\/span>conturi <\/span>ar <\/span>trebui <\/span>configurate <\/span>cu <\/span>permisiuni <\/span>minime, <\/span>izolate <\/span>de <\/span>conturile\nutilizatorilor \u0219i monitorizate separat pentru a sprijini auditabilitatea \u0219i\nautomatizarea securizat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea principiului privilegiului minim<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>de <\/span>serviciu <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>doar <\/span>permisiunile <\/span>necesare\n<\/span>pentru <\/span>func\u021bionarea <\/span>lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceasta <\/span>limiteaz\u0103 <\/span>poten\u021bialele <\/span>utiliz\u0103ri\n<\/span>abuzive <\/span>\u0219i <\/span>sprijin\u0103\n<\/span>opera\u021biunile <\/span>securizate <\/span>at\u00e2t <\/span>\u00een\nmediile IT<\/span>, c\u00e2t \u0219i \u00een cele OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i auditarea activit\u0103\u021bii conturilo<\/span>r de serviciu<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ac\u021biunile <\/span>efectuate <\/span>de <\/span>conturile <\/span>de <\/span>serviciu <\/span>ar <\/span>trebui <\/span>jurnalizate <\/span>\u0219i <\/span>revizu<\/span>ite <\/span>periodic. <\/span>Aceasta \u00eembun\u0103t\u0103\u021be\u0219te trasabilitatea \u0219i\najut\u0103 la detec\u021bia anomaliilor sau a utiliz\u0103rii abuzive.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea politicilor de inactivitate a <\/span>datelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>de <\/span>acces <\/span>ale <\/span>sistemului, <\/span>inclusiv <\/span>cele <\/span>ale <\/span>conturilor <\/span>de <\/span>serviciu <\/span>\u0219i <\/span>ale <\/span>utilizatorilor<\/span>, <\/span>ar trebui <\/span>dezactivate <\/span>automat <\/span>dup\u0103 <\/span>o <\/span>perioad\u0103 <\/span>definit\u0103\n<\/span>de <\/span>inactivitate. Excep\u021biile <\/span>ar <\/span>trebui\ndocumentate \u0219i justificate, \u00een special \u00een mediile <\/span>O<\/span>T <\/span>\u00een care func\u021bionarea continu\u0103 este\ncritic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea procedurilor formale de acces pentru\np\u0103r\u021bile externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>extern <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>un <\/span>proces <\/span>definit,\n<\/span>care <\/span>s\u0103 <\/span>includ\u0103 <\/span>niveluri <\/span>de <\/span>acces <\/span>bazate pe\n<\/span>roluri, <\/span>etape <\/span>de <\/span>autorizare, <\/span>verificarea <\/span>identit\u0103\u021b<\/span>ii <\/span>\u0219i <\/span>instruire <\/span>pentru\n<\/span>con\u0219tientizare. <\/span>Ar <\/span>trebui s\u0103 existe mecanisme de\nmonitorizare \u0219i revocare pentru a <\/span>gestiona\n\u00eenc\u0103lc\u0103rile accesului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Luarea \u00een co<\/span>nsiderare\na aspectelor specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>politicile <\/span>de <\/span>dezactivare <\/span>a <\/span>datelor <\/span>de <\/span>acces <\/span>ar <\/span>tr<\/span>ebui <\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>cont <\/span>de <\/span>cerin\u021bele\nprivind <\/span>timpul <\/span>de <\/span>func\u021bionare <\/span>a <\/span>sistemului, <\/span>componentele <\/span>gestionate <\/span>de <\/span>v\u00e2nz\u0103tori\n<\/span>\u0219i <\/span>sistemele vechi. <\/span>Poate <\/span>fi <\/span>necesar\u0103 coordonarea <\/span>cu <\/span>echipele <\/span>de <\/span>ingineri <\/span>pentru <\/span>evitarea <\/span>\u00eentreruperilor opera\u021bionale<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru tranzac\u021biile din cadrul\nsistemelor critice ale organiza\u021bi<\/span>ei,\norganiza\u021bia trebuie s\u0103 implemente<\/span>ze\nMFA, certificate criptografice, token<\/span>-uri\nde identitate, chei criptografice \u0219i alte date de acces, dup\u0103 caz \u0219i acolo unde\neste fezabil.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura aplicarea unor mecanisme puternice <\/span>de\nautentificare pentru tranzac\u021biile <\/span>din <\/span>cadrul <\/span>sistemelor <\/span>critice. Aceasta <\/span>include <\/span>utilizarea <\/span>MFA <\/span>(PR.AA<\/span>-03.2), <\/span>a\ndatelor de acces criptografice \u0219i a altor metode securizate pentru p<\/span>rotejarea opera\u021biunilor sensibile \u0219i a\nschimburil<\/span>or de date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea autentific\u0103rii puternice tranzac\u021biilor\ncritice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ranzac\u021biile <\/span>care <\/span>implic\u0103\n<\/span>accesul <\/span>la <\/span>date <\/span>sensibile, <\/span>modific<\/span>\u0103ri <\/span>ale <\/span>configura\u021biei <\/span>sistemului, executarea <\/span>de <\/span>comenzi, <\/span>autentificarea <\/span>utilizatorilor\/dispozitivelor <\/span>sau <\/span>transmiterea de <\/span>date \u00eentre sisteme ar trebui protejate utiliz\u00e2nd MF<\/span>A, token<\/span>-uri\nde identitate, chei criptografice sau certificate, acolo unde este fezabil.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea autentific\u0103rii bazate pe <\/span>context \u0219i comportament<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Autentificarea <\/span>puternic\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>verific\u0103ri <\/span>bazate <\/span>pe <\/span>context\n<\/span>(de <\/span>exemplu, <\/span>loca\u021bie, or\u0103, dispozitiv) \u0219i date\nbiometrice co<\/span>mportamentale (de\nexemplu, tipare de <\/span>tastare) pentru\ndetec\u021bia anomaliilor \u0219i \u00eembun\u0103t\u0103\u021birea securit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Combinarea MF<\/span>A <\/span>cu autentificare unic\u0103 (SSO)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>MF<\/span>A <\/span>ar trebui integrat\u0103 cu solu\u021bii SS<\/span>O pentru a simplifica accesul, men\u021bin\u00e2nd\n\u00een acela\u0219i timp o protec\u021bie robust\u0103 pentru sistemele critice interne \u0219i\nexterne.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Gestionarea securizat\u0103 a datelor de acces\ncriptografice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Certificatele <\/span>criptografice, <\/span>token<\/span>-urile <\/span>de <\/span>identitate <\/span>\u0219i <\/span>cheile <\/span>ar <\/span>trebui <\/span>emise, <\/span>stocate, <\/span>rotite <\/span>\u0219i\nrevocate <\/span>securizat. <\/span>Aceasta\n<\/span>sus\u021bine <\/span>implementarea <\/span>securizat\u0103 <\/span>a <\/span>mecanismelor <\/span>de <\/span>autent<\/span>ificare puternice <\/span>cerute <\/span>de <\/span>acest <\/span>Control <\/span>\u0219i <\/span>completeaz\u0103 <\/span>PR.AA<\/span>-03.2, <\/span>care <\/span>impune <\/span>MF<\/span>A\npentru accesul la distan\u021b\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>metodele\n<\/span>de <\/span>autentificare <\/span>ar <\/span>trebui <\/span>adaptate\n<\/span>la <\/span>constr\u00e2<\/span>ngerile\n<\/span>sistemului, echipamentele <\/span>vechi <\/span>\u0219i <\/span>cerin\u021bele <\/span>de <\/span>continuitate <\/span>oper<\/span>a\u021bional\u0103.\nPoate <\/span>fi necesar\u0103 <\/span>coordonarea cu echipele de ingineri pentru\na implementa solu\u021bii fezabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-01.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Sistemele <\/span>critice <\/span>ale <\/span>organiza\u021biei <\/span>trebuie <\/span>monitorizate <\/span>pentru <\/span>detec\u021bia <\/span>utiliz\u0103rii <\/span>atipice <\/span>a <\/span>datelor\n<\/span>de acces de sistem. Datele de acces asociate cu <\/span>un risc semnificativ trebuie dezactivate.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\ndetec<\/span>ta \u0219i de a r\u0103spunde la\nutilizarea anormal\u0103 sau cu risc ridicat a <\/span>datelor <\/span>de <\/span>acces <\/span>de <\/span>sistem <\/span>\u00een <\/span>sistemele <\/span>critice,\n<\/span>contribuind <\/span>la <\/span>prevenirea <\/span>accesului neautorizat, <\/span>a\namenin\u021b\u0103rilor din interior \u0219i a atacurilor bazate pe date de acces.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Detec\u021bia utiliz\u0103rii atipice a datelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>ar <\/span>trebui\n<\/span>monitorizate <\/span>pentru <\/span>detec\u021bia\n<\/span>abaterilor <\/span>de <\/span>la <\/span>tiparele <\/span>normale\n<\/span>de <\/span>utilizare <\/span>a datelor de acces, precum orele de\nautentificare neobi\u0219nuite, accesul din loca\u021bii necunoscute, utilizarea de\nsisteme necunoscute, autentific\u0103ri si<\/span>multane\ndin loca\u021bii \u00eendep\u0103rtate sau accesul brusc la date sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Limitarea <\/span>\u0219i <\/span>r\u0103spunsul <\/span>la <\/span>\u00eencerc\u0103rile <\/span>e\u0219uate\n<\/span>de <\/span>autentificare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar trebui s\u0103 fie pus \u00een aplicare un prag pentru <\/span>\u00eencerc\u0103rile de autentificare e\u0219uate.\nConturile ar trebui <\/span>s\u0103 <\/span>fie <\/span>blocate <\/span>automat\n<\/span>dup\u0103 <\/span>e\u0219ecuri <\/span>repetate\n<\/span>\u0219i <\/span>s\u0103 <\/span>r\u0103m\u00e2n\u0103 <\/span>inaccesibile <\/span>p\u00e2n\u0103 <\/span>la <\/span>expirarea unei perioade de blocare\ndefinite sau p\u00e2n\u0103 c\u00e2nd un administrator autorizat le reseteaz\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Gestionarea ciclului de via\u021b\u0103 al datelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Emiterea, <\/span>utilizarea <\/span>\u0219i <\/span>re<\/span>vocarea\n<\/span>date<\/span>lor <\/span>de <\/span>acc<\/span>es <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>automatizate, <\/span>acolo <\/span>unde <\/span>este posibil. Ar <\/span>trebui <\/span>men\u021binut <\/span>un <\/span>inventar <\/span>actualizat <\/span>al <\/span>datelor <\/span>de <\/span>acces <\/span>active,\n<\/span>iar <\/span>conturile neutilizate sau\nabandonate ar trebui s\u0103 fie rev<\/span>izuite\n\u0219i dezactivate periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i corelarea evenime<\/span>ntelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>luate\n<\/span>\u00een <\/span>considerare <\/span>instrumente <\/span>SIEM <\/span>sau <\/span>solu\u021bii\n<\/span>echivalente <\/span>pentru <\/span>detec\u021bia anomaliilor <\/span>\u0219i <\/span>corelarea <\/span>evenimentelor <\/span>\u00eentre <\/span>sisteme. Ar <\/span>trebui <\/span>imp<\/span>lementate <\/span>referin\u021be comportamentale pentru identificarea abat<\/span>erilor de la utilizarea obi\u0219nuit\u0103<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dezactivarea automat\u0103 a datelor de acces cu risc\nridicat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele  <\/span><\/span>de  <\/span><\/span>acces  <\/span><\/span>asociate  <\/span><\/span>cu  <\/span><\/span>activit\u0103\u021bi  <\/span><\/span>anomale\n <\/span><\/span>confirmate\n <\/span><\/span>sau\n <\/span><\/span>cu\n <\/span><\/span>risc\n <\/span><\/span>ridicat\n <\/span><\/span>ar\n <\/span><\/span>trebui\ndezactivate imediat. Echipele de securitate ar treb<\/span>ui notificate pentru investigare \u0219i r\u0103s<\/span>puns. T<\/span>oate ac\u021biunile\nar trebui jurnalizate \u00een scopuri de audit \u0219i criminalistic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Cre\u0219terea gradului de con\u0219tientizare a utilizatorilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizatorii <\/span>ar <\/span>trebui <\/span>instrui\u021bi <\/span>cu <\/span>privire <\/span>la <\/span>practicile <\/span>de <\/span>utilizare <\/span>securizat\u0103 <\/span>a <\/span>datelor <\/span>de <\/span>acces\n\u0219i \u00eencuraja\u021bi s\u0103 raporteze <\/span>activit<\/span>\u0103\u021bi <\/span>suspecte\nsau anomalii \u00een comportamentul de acces.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Identit\u0103\u021bile s<\/span>unt\nverificate \u0219i legate de date de acces pe baza\n<\/span>contextului interac\u021biunilor.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>im<\/span>plementeze <\/span>proceduri\n<\/span>documentate <\/span>pentru <\/span>verificarea <\/span>identit\u0103\u021bii <\/span>persoanelor\nfizice \u00eenainte de emiterea datelor de acces care ofer\u0103 acces la sistemele\norganiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl, care se bazeaz\u0103 pe G<\/span>V.RR<\/span>-04.1, este de a asigura c\u0103 numai\npersoanele fizice <\/span>verificate <\/span>primesc\n<\/span>date <\/span>de <\/span>acces,\n<\/span>reduc\u00e2nd <\/span>astfel <\/span>riscul\n<\/span>de <\/span>fraud\u0103 <\/span>de <\/span>identitate, <\/span>acces\n<\/span>neautori<\/span>zat \u0219i amenin\u021b\u0103ri din\ninterior.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unor proceduri documentate de verificare a\nidentit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>elaborat\n<\/span>\u0219i <\/span>aprobat <\/span>un <\/span>proces <\/span>formal <\/span>de <\/span>verificare <\/span>a <\/span>identit\u0103\u021bii <\/span>\u00eenainte\n<\/span>de <\/span>eliberarea datelor <\/span>de <\/span>acces. <\/span>Acest <\/span>proces <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>asigure <\/span>r\u0103spunderea, <\/span>trasabilitatea <\/span>\u0219i <\/span>auditabilitatea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea identit\u0103\u021bii folosind surse\n<\/span>de \u00eencredere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>erificarea <\/span>identit\u0103\u021bii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>bazat\u0103 <\/span>pe <\/span>documente\n<\/span>oficiale, <\/span>precum <\/span>c\u0103r\u021bi <\/span>de <\/span>identitate, pa\u0219apoarte <\/span>sau <\/span>permise\nde <\/span>conducere, <\/span>eliberate <\/span>de <\/span>autorit\u0103\u021bi. <\/span>\u00cen <\/span>ceea <\/span>ce <\/span>prive\u0219te <\/span>procesul <\/span>de\nintegrare or<\/span>ganiza\u021bional\u0103 la distan\u021b\u0103\nsau digital, practicile ar tr<\/span>ebui s\u0103\nfie aliniate cu bunele practici ale ENISA <\/span>\u00een\nmaterie de verificare a identit\u0103\u021bii la distan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Prevenirea fraudei de identitate \u0219i a utiliz\u0103rii\nabuzive<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>controale <\/span>pentru <\/span>detec\u021bia <\/span>\u0219i <\/span>prevenirea <\/span>furtului <\/span>de <\/span>identitate sau <\/span>a <\/span>uzurp\u0103rii <\/span>identit\u0103\u021bii. <\/span>Aceasta <\/span>contribuie <\/span>la <\/span>reducerea <\/span>riscului\n<\/span>de <\/span>pierderi <\/span>financiare, <\/span>de afectare a reputa\u021biei \u0219i de acces neautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea adapt\u0103rii relevante pentru OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesele <\/span>de <\/span>verificare <\/span>a <\/span>identit\u0103\u021bii <\/span>ar <\/span>trebui <\/span>adaptate\n<\/span>med<\/span>iilor <\/span>OT<\/span>, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>cazul <\/span>\u00een <\/span>care\ntehnicienii ter\u021bi sau personalul v\u00e2nz\u0103torilor necesit\u0103 acces la sisteme\ncritice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>se <\/span>asigure <\/span>c\u0103 <\/span>utilizeaz\u0103 <\/span>date <\/span>de <\/span>acces\n<\/span>unice <\/span>pentru <\/span>fiecare\n<\/span>utilizator, <\/span>dispozitiv \u0219i <\/span>proces <\/span>autentificat <\/span>care <\/span>interac\u021bioneaz\u0103 <\/span>cu <\/span>sistemele <\/span>critice ale <\/span>organiza\u021biei. <\/span>Aceste <\/span>date <\/span>de <\/span>acces trebuie verificate, iar\nidentificatorii unici trebuie \u00eenregistra\u021bi \u00een timpul interac\u021biunilor cu\nsistemul. Se pot <\/span>face <\/span>excep\u021bii\n<\/span>pentru <\/span>accesul <\/span>de <\/span>urgen\u021b\u0103 <\/span>(proceduri <\/span>break<\/span>-glass), cu <\/span>condi\u021bia\n<\/span>ca <\/span>acest <\/span>acces <\/span>s\u0103 <\/span>fi<\/span>e\nstrict controlat, jurnalizat \u0219i revizuit.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>fiecare <\/span>utilizator, dispozitiv <\/span>\u0219i <\/span>proces <\/span>care interac\u021bioneaz\u0103 cu siste<\/span>mele critice este identificabil \u0219<\/span>i autentificat \u00een mod unic. Aceasta\nsprijin\u0103 r\u0103spunderea, <\/span>trasabilitatea <\/span>\u0219i <\/span>accesul <\/span>securizat, <\/span>permi\u021b\u00e2nd <\/span>\u00een <\/span>acela\u0219i\n<\/span>timp <\/span>excep\u021bii <\/span>controlate <\/span>\u00een <\/span>situa\u021bii de\nurgen\u021b\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Atribuirea de date de acces unice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare <\/span>utilizator<\/span>, <\/span>dispozitiv <\/span>\u0219i <\/span>proc<\/span>es <\/span>automatizat <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>propriile\n<\/span>date <\/span>de <\/span>acces unice. <\/span>Conturile <\/span>partajate\n<\/span>ar <\/span>trebui <\/span>evitate.\n<\/span>T<\/span>oate <\/span>datele <\/span>de <\/span>acces <\/span>ar <\/span>trebui <\/span>verificate <\/span>\u00eenainte\n<\/span>de acordarea accesului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea <\/span>autentific\u0103rii\nputernice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>MF<\/span>A <\/span>(PR.AA-03.2) <\/span>trebuie <\/span>utilizat\u0103 <\/span>ori <\/span>de <\/span>c\u00e2te <\/span>ori <\/span>este <\/span>fezabil. <\/span>Mecanismele <\/span>de <\/span>autentificare ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>rezistente <\/span>la <\/span>atacurile <\/span>prin <\/span>reluare <\/span>\u0219i <\/span>la <\/span>reutilizarea <\/span>datelor <\/span>de <\/span>acces. Aceste practici sunt aliniate cu\nGhidul privi<\/span>nd autentifi<\/span>carea securizat\u0103 a utiliz<\/span>atorilor elaborat de c\u0103tre <\/span>ENISA, <\/span>care <\/span>recomand\u0103\n<\/span>autentificarea <\/span>stratificat\u0103 <\/span>\u0219i <\/span>contextual\u0103 <\/span>pentru <\/span>sistemele <\/span>critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na practicilor de management al datelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politicile <\/span>privind <\/span>parolele\n<\/span>\u0219i <\/span>rota\u021bia <\/span>datelor\n<\/span>de <\/span>acces <\/span>ar <\/span>trebui <\/span>puse <\/span>\u00een <\/span>aplicare.\n<\/span>Datele <\/span>de <\/span>acces ar\n<\/span>trebui revizuite <\/span>\u0219i <\/span>actualizate <\/span>periodic, <\/span>\u00een <\/span>special <\/span>dup\u0103\nmodific\u0103ri <\/span>de <\/span>rol sau <\/span>dup\u0103 <\/span>procesul de <\/span>ie\u0219ire <\/span>or<\/span>ganiza\u021bional\u0103. Aceasta <\/span>sus\u021bine <\/span>principiile <\/span>prev<\/span>\u0103zute <\/span>\u00een <\/span>Ghidul <\/span>tehnic <\/span>de\nimplementare a NIS 2 (<\/span>T<\/span>echnical Implementation Guidance On\nCommission Implementing Regulation <\/span>(EU) <\/span>2024\/2690\n<\/span>of <\/span>17 <\/span>October <\/span>2024 <\/span>laying <\/span>down <\/span>rules <\/span>for <\/span>the <\/span>application <\/span>of <\/span>NIS2<\/span><\/p>\n\n

Directive\nas regards technical and methodological requir<\/span>ements\nof cybersecurity risk<\/span>– management\nmeasures), ultima versiune, <\/span>e<\/span>laborat de c\u0103tre ENISA, care subliniaz\u0103\nmanagementul securizat al ciclului d<\/span>e\nvia\u021b\u0103 al identit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea controlului accesului \u0219i monitorizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>respecte <\/span>principi<\/span>ul <\/span>privilegiului <\/span>minim. <\/span>Jurnalele <\/span>\u0219i <\/span>pistele <\/span>de <\/span>audit <\/span>ar trebui  <\/span><\/span>monitorizate  <\/span><\/span>continuu\n <\/span><\/span>pentru\n <\/span><\/span>detec\u021bia  <\/span>anomaliilor<\/span>. <\/span>Activit\u0103\u021bile  <\/span><\/span>suspecte  <\/span><\/span>ar  <\/span><\/span>trebui\ninvestigate prompt.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controlul accesului de ur<\/span>gen\u021b\u0103 (break-glass)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>de <\/span>ur<\/span>gen\u021b\u0103 <\/span>ar <\/span>trebui <\/span>acordat\n<\/span>numai <\/span>p<\/span>rin <\/span>conturi <\/span>break-glass <\/span>desemnate. <\/span>Aceste <\/span>conturi ar trebui controlate strict,\nlimitate \u00een timp, jurnalizate integral \u0219i revizuite dup\u0103 utilizare. Pentru\nfiecare caz ar trebui s\u0103 fie necesar\u0103 justifi<\/span>carea\n\u0219i aprobarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Promovarea con\u0219tientiz\u0103rii \u0219i instrui<\/span>rii utilizatorilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Personalul <\/span>ar <\/span>trebui\n<\/span>instruit <\/span>cu <\/span>privire\n<\/span>la <\/span>importan\u021ba <\/span>utiliz\u0103rii <\/span>datelor <\/span>de <\/span>acces\n<\/span>individuale <\/span>\u0219i <\/span>a raport\u0103rii <\/span>accesului <\/span>suspect. <\/span>Con\u0219tie<\/span>ntizarea <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>riscurile\n<\/span>asociate <\/span>partaj\u0103rii <\/span>\u0219i utiliz\u0103rii abuzive a datelor de acces<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>datele\n<\/span>de <\/span>acces <\/span>unice\n<\/span>ar <\/span>trebui <\/span>implementate <\/span>\u00eentr-un <\/span>mod <\/span>care <\/span>s\u0103 <\/span>respecte constr\u00e2ngerile <\/span>opera\u021bionale <\/span>\u0219i <\/span>limit\u0103rile <\/span>sistemului. <\/span>Poate <\/span>fi <\/span>necesar\u0103\n<\/span>coordonarea <\/span>cu <\/span>echipele de ingineri.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Utilizatorii, serviciile \u0219i hardware<\/span>-ul sunt autentificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Toate punctele de acces\nwireless utilizate de organiza\u021bie, inclusiv cele care ofer\u0103 acces pentru\nvizitatori, <\/span>trebuie <\/span>configurate, <\/span>gestionate <\/span>\u0219i <\/span>monitorizate <\/span>\u00een <\/span>mod <\/span>securizat <\/span>pentru <\/span>prev<\/span>enirea\n<\/span>accesului neautorizat \u0219i asigurarea integrit\u0103\u021bii re\u021belei.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>toate <\/span>punctele\n<\/span>de <\/span>acces <\/span>wirel<\/span>ess, <\/span>inclusiv\n<\/span>cele <\/span>destinate utiliz\u0103rii de\nc\u0103tre vizitatori, sunt configurate, gestionate \u0219i <\/span>monitorizate \u00een mod securizat, pentru prevenirea accesului neautorizat\n\u0219i protejarea integrit\u0103\u021bii re\u021belei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Securitatea <\/span>general\u0103\nwireless<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele\nde acces administrative impl<\/span>ic<\/span>ite ar trebui modificate imediat dup\u0103\ninstalare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ransmisia <\/span>identificatorului <\/span>setului\n<\/span>de <\/span>servicii <\/span>(SSID)\n<\/span>ar <\/span>trebui <\/span>dezac<\/span>tivat\u0103, <\/span>cu <\/span>excep\u021bia\ncazului \u00een care este neces<\/span>ar\u0103\nopera\u021bional.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizate\n<\/span>protocoale <\/span>de <\/span>criptare\n<\/span>puternice <\/span>(de <\/span>exemplu,\n<\/span>W<\/span>i<\/span>-Fi <\/span>Protected <\/span>Access <\/span>2 <\/span>– WP<\/span>A2\nsau <\/span>W<\/span>i-Fi Protected <\/span>Access\n3 – <\/span>WP<\/span>A3 cu standard avansat de criptare – <\/span>AES).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul\nfizic la punctele de acces wireless ar trebui restric\u021bionat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Firmware-ul\nar trebui actualizat periodic pentru a remedia vulnerabilit\u0103\u021bile cunoscu<\/span>te.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Re\u021belele <\/span>wireless <\/span>ar <\/span>trebui <\/span>monitorizate <\/span>pentru <\/span>detec\u021bia <\/span>punctelor <\/span>de <\/span>acces <\/span>neautorizate <\/span>\u0219i activit\u0103\u021bilor <\/span>suspecte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Securitatea <\/span>W<\/span>i<\/span>-Fi\npentru vizitatori<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Re\u021belele <\/span>pentru <\/span>vizitatori <\/span>ar <\/span>trebui <\/span>iz<\/span>olate <\/span>de <\/span>sistemele <\/span>interne\n<\/span>folosind <\/span>re<\/span>\u021bele <\/span>locale <\/span>virtuale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(VLAN)\nsau SSID-uri separate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Limit\u0103rile <\/span>de <\/span>l\u0103\u021bime\n<\/span>de <\/span>band\u0103 <\/span>\u0219i <\/span>restric\u021biile <\/span>de <\/span>acces <\/span>ar <\/span>trebui <\/span>aplicate\n<\/span>re\u021belelor <\/span>pentru vizitatori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Portalurile <\/span>captive <\/span>ar <\/span>tre<\/span>bui <\/span>utilizate <\/span>pentru <\/span>afi\u0219area <\/span>termenilor <\/span>de <\/span>utilizare <\/span>\u0219i, <\/span>op\u021bional, <\/span>pentru jurnalizarea <\/span>accesului <\/span>vizitatorilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele\nsensibile nu ar trebui stocate sau transmise prin re\u021belele pentru vizitatori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>W<\/span>i-Fi-ul <\/span>pentru <\/span>vizitatori <\/span>ar <\/span>trebui <\/span>dezactivat <\/span>c\u00e2nd <\/span>nu <\/span>este <\/span>utilizat <\/span>sau <\/span>\u00een <\/span>afara <\/span>programului <\/span>de lucru, dac\u0103 este fezabil.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Practici privind endpoint-urile \u0219i utilizatorii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitivele <\/span>care <\/span>se <\/span>conecteaz\u0103 <\/span>la <\/span>re\u021belele <\/span>wireless\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>politicile <\/span>de <\/span>securitate pentru\nendpoint-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>VPN-urile <\/span>ar <\/span>trebui <\/span>utilizate <\/span>atunci <\/span>c\u00e2nd <\/span>se <\/span>realizeaz\u0103 <\/span>conexiuni <\/span>la <\/span>re\u021bele <\/span>necunoscute <\/span>sau nesecurizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>de <\/span>acces <\/span>W<\/span>i-Fi <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>politicile <\/span>privind <\/span>parolele <\/span>care <\/span>impun <\/span>complexitate \u0219i actualiz\u0103ri <\/span>periodice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

MFA trebuie s\u0103 fie obligatorie pentru accesu<\/span>l la distan\u021b\u0103 la re\u021belele organiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de\na proteja <\/span>re\u021belele organiza<\/span>\u021biei <\/span>prin\nsolicitarea MFA pentru toate acces\u0103rile la distan\u021b\u0103, reduc\u00e2nd astfel riscul\naccesului neautorizat \u0219i al atacurilor bazate pe date de acces.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een cons<\/span>iderare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\ngeneral\u0103 a MF<\/span>A<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>MF<\/span>A ar <\/span>trebui <\/span>pus\u0103 <\/span>\u00een <\/span>aplicare <\/span>pe <\/span>toate <\/span>sistemele\n<\/span>expuse <\/span>la <\/span>internet,\n<\/span>inclusiv <\/span>pentru <\/span>e<\/span>-mail,\nVPN-uri, protocol desktop la distan\u021b\u0103 (RDP), servicii cloud \u0219i portaluri web.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>acces\u0103rile <\/span>la <\/span>distan\u021b\u0103, <\/span>inclusiv\n<\/span>acce<\/span>sul <\/span>v\u00e2nz\u0103torilor <\/span>\u0219i <\/span>contractorilor <\/span>ter\u021bi, <\/span>ar <\/span>trebui\n<\/span>s\u0103 necesite MF<\/span>A.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Selectarea tehnologiei MF<\/span>A<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Metodele <\/span>MF<\/span>A <\/span>ar <\/span>trebui <\/span>selectate <\/span>pe <\/span>baza <\/span>nivelului\n<\/span>de <\/span>securitate, <\/span>a <\/span>rezisten\u021bei <\/span>la <\/span>phishing <\/span>\u0219i <\/span>a\ncompatibilit\u0103\u021bii opera\u021bionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Op\u021biunile\nob<\/span>i\u0219nuite includ:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>T<\/span>oken-uri\n<\/span>hardware <\/span>parol\u0103 <\/span>unic\u0103 <\/span>bazat\u0103 <\/span>pe <\/span>timp <\/span>(T<\/span>OTP) <\/span>– <\/span>secur<\/span>izate, <\/span>rezisten\u021b\u0103 <\/span>limitat\u0103\n<\/span>la phishing.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Aplica\u021bii\nde autentificare (softwa<\/span>re <\/span>T<\/span>OTP) <\/span>– utilizate la scar\u0103 lar<\/span>g\u0103, securitate moderat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Chei de acces – f\u0103r\u0103 parol\u0103, u\u0219or de\nutilizat, securizate din punct de vedere criptografic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Fast\n <\/span><\/span>Identity\n <\/span><\/span>Online\n <\/span><\/span>2\n <\/span><\/span>(FIDO2)\n <\/span><\/span>–\n <\/span><\/span>bazat\n <\/span><\/span>pe\n <\/span><\/span>platform\u0103\n <\/span><\/span>sau\n <\/span><\/span>hardware\n <\/span><\/span>–\n <\/span><\/span>autentificare\ncriptografic\u0103 puternic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Aplica\u021bii <\/span>capabile\n<\/span>s\u0103 <\/span>trimit\u0103 <\/span>automat\n<\/span>date <\/span>c\u0103tre <\/span>utilizator <\/span>– <\/span>convenabile, <\/span>dar <\/span>ar <\/span>putea\n<\/span>fi vulnerabile la oboseal\u0103 cauzat\u0103 de notific\u0103ri push.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>MF<\/span>A <\/span>bazat\u0103\npe SMS \u0219i e-mail ar trebui evitat\u0103 din cauza vulnerabilit\u0103\u021bilor de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>M\u0103suri de securitate auxiliare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politicile\nprivind parolele puternice ar trebui puse \u00een aplicare \u00eempreun\u0103 <\/span>cu MF<\/span>A.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizatorii\nar trebui instrui\u021bi s\u0103 se deconecteze \u00een mod explicit din sesiuni.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele\n\u0219i platformele antimalware ar trebui actualizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>efectuat\u0103 <\/span>instruire\n<\/span>periodic\u0103 <\/span>pentru <\/span>con\u0219tientizare <\/span>\u00een <\/span>privin\u021ba <\/span>atacurilor <\/span>de <\/span>phishing.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii specifice O<\/span>T <\/span>privind MF<\/span>A <\/span>(a\nse vedea \u0219i PR.AA-01.1)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acces\npartajat la PLC-uri\/HMI-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Dac\u0103 <\/span>conturile\n<\/span>individuale <\/span>nu <\/span>sunt <\/span>fezabile, <\/span>ar <\/span>trebui <\/span>aplicat\n<\/span>principiul <\/span>privilegiului\nminim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>T<\/span>rebuie\n<\/span>utilizat <\/span>un <\/span>server\n<\/span>jump <\/span>securizat <\/span>sau <\/span>un <\/span>frontend\n<\/span>HMI <\/span>pentru <\/span>controlul <\/span>accesului, jurnalizarea activit\u0103\u021bii \u0219i <\/span>ad\u0103ugarea unui nivel de autentificare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acces\nsecurizat la distan\u021b\u0103 la sistemele OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Cerin\u021bele\nte<\/span>hnice \u0219i procedurale pentru\naccesul la <\/span>distan\u021b\u0103 ar trebui\ndefinite \u00een mod clar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span> <\/span>  <\/span> <\/span><\/span>Ar trebui utilizate protocoale securiz<\/span>ate (de exemplu, <\/span>VPN, SSH, <\/span>TLS).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>MF<\/span>A <\/span>ar <\/span>trebui <\/span>impus\u0103 <\/span>pentru <\/span>toate <\/span>acces\u0103rile <\/span>OT <\/span>la <\/span>distan\u021b\u0103,\n<\/span>\u00een <\/span>special <\/span>pentru <\/span>furnizorii\nter\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Controalele <\/span>de <\/span>acces <\/span>JIT <\/span>ar <\/span>trebui <\/span>utilizate <\/span>pentru\n<\/span>a <\/span>acorda <\/span>acces <\/span>temporar<\/span>, <\/span>limitat <\/span>\u00een <\/span>timp.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>T<\/span>oate acces\u0103rile la distan\u021b\u0103 ar trebui\njurnalizate \u0219i monitorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Integrare\n\u0219i compatibilit<\/span>ate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Solu\u021bia\nMF<\/span>A\n<\/span>ar trebui s\u0103 fie compatibil\u0103 at\u00e2t cu sistemele IT<\/span>, c\u00e2t \u0219i cu cele OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Integrarea\nar trebui testat\u0103 \u00een medii O<\/span>T <\/span>pentru a evita \u00eentreruperile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>\u00cen\n <\/span><\/span>cazul\n <\/span><\/span>\u00een\n <\/span><\/span>care\n <\/span><\/span>integra<\/span>rea  <\/span><\/span>direct\u0103  <\/span><\/span>nu  <\/span><\/span>este\n <\/span><\/span>posibil\u0103,\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>utilizate\n <\/span><\/span>platforme\nintermediare securizate (de exemplu, servere jump).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-03.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\ndefineasc\u0103, documenteze \u0219i implementeze restric\u021bii de utilizare, cerin\u021be de\nconectare \u0219i proceduri de <\/span>autorizare\npentru accesul la distan\u021b\u0103 la sistemele sale critice. Aceste controale trebuie\ns\u0103 asigure c\u0103 numai utilizatorii aproba\u021bi se pot conecta, folosind metode\nsecurizate, cu acces limitat la ceea ce este necesar pentru rolul lor.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 accesul la distan\u021b\u0103 la sistemele critice este\nstrict controlat prin restric\u021bii de utilizare definite, meto<\/span>de de conectare securizate \u0219i procedu<\/span>ri formale de autorizare. Aceasta ajut\u0103 la\nprevenirea accesului n<\/span>eautorizat \u0219i\nlimiteaz\u0103 expunerea la amenin\u021b\u0103rile cibernetice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea re<\/span>stric\u021biilor\nde utilizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea sistemelor care <\/span>sunt critice (de exemplu, sisteme OT<\/span>, serv<\/span>ere de\nproduc\u021bie, baze de date financiare). Definirea persoanelor sau rolurilor care\npot avea acces la acestea la distan\u021b\u0103 <\/span>(de\nexemplu, <\/span>roluri <\/span>specifice, <\/span>v\u00e2nz\u0103tori ter\u021bi). <\/span>Limitarea <\/span>accesului\n<\/span>la <\/span>intervalele <\/span>de timp aprobate \u0219i restric\u021bionarea\nacestuia numa<\/span>i la sistemele \u0219i\nfunc\u021biile necesare pentru rolul utilizatorului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea unor cerin\u021be de conectare securizat\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>la <\/span>distan\u021b\u0103\n<\/span>ar <\/span>trebui <\/span>stabilit\n<\/span>utiliz\u00e2nd <\/span>metode <\/span>securizate, <\/span>precum <\/span>VPN<\/span>-uri <\/span>cu <\/span>criptare puternic\u0103, TLS\/SSH <\/span>sau <\/span>servere <\/span>jump <\/span>pentru <\/span>medi<\/span>i <\/span>OT<\/span>. <\/span>T<\/span>ot <\/span>accesul\n<\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui\nprotejat prin MF<\/span>A, \u00een conformitate cu\nPR.AA<\/span>-03.2. Dispoziti<\/span>vele utilizate pentru accesul la distan\u021b\u0103\nar trebui s\u0103 \u00eendeplineasc\u0103 cerin\u021bele de securitate ale endpoint<\/span>-urilor (de exemplu, antivirus, aplicarea\nde patch<\/span>-uri).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i aprobarea accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>O <\/span>politic\u0103 <\/span>de <\/span>acces <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>defineasc\u0103 <\/span>procedurile <\/span>de <\/span>solicitare <\/span>\u0219i <\/span>aprobare,\nrolurile <\/span>\u0219i <\/span>cerin\u021bele <\/span>tehnice. <\/span>Ar <\/span>trebui <\/span>men\u021binut <\/span>un <\/span>registru <\/span>al <\/span>utilizatorilor <\/span>la <\/span>distan\u021b\u0103, <\/span>care <\/span>s\u0103\ninclud\u0103 domeniul de acces, datele de aprobare \u0219i termenele de revizuire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i revizuirea accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>sesiunile <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>jurnalizate, <\/span>captur\u00e2nd <\/span>identitatea <\/span>utilizatorului, <\/span>ora, <\/span>durata \u0219i\nsistemele accesate. Jurnalele ar tr<\/span>ebui\nrevizuite periodic p<\/span>entru detec\u021bia anomaliilor<\/span>. Permisiunile \u0219i configura\u021biile de acces\nla distan\u021b\u0103 ar trebui auditate periodic.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea controalelor specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>sistemele <\/span>OT<\/span>, <\/span>accesul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>direc\u021bionat <\/span>prin <\/span>interfe\u021be <\/span>fro<\/span>ntend <\/span>securizate\n<\/span>sau servere jump. Dac\u0103 sunt necesare conturi partajate (de exemplu,\npentru PLC<\/span>-uri sau HMI- uri), <\/span>accesul\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>jurnalizat, <\/span>limitat <\/span>\u00een <\/span>timp, <\/span>protejat <\/span>prin <\/span>MF<\/span>A <\/span>la <\/span>nivelul\n<\/span>serverului jump \u0219i s\u0103 respecte princi<\/span>piul\nprivilegiului minim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103ril<\/span>e ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>Ghidul <\/span>tehnic <\/span>de <\/span>imp<\/span>lementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de c\u0103tre ENISA, care recomand\u0103 politici de\nacces securizat la d<\/span>istan\u021b\u0103,\nautentificare puternic\u0103 \u0219i monitorizare continu\u0103 ca parte a managementului\nriscului de se<\/span>curitate cibernetic\u0103\npentru sistemele cri<\/span>tice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-03.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Accesul  <\/span><\/span>la  <\/span><\/span>distan\u021b\u0103  <\/span><\/span>la  <\/span><\/span>sistemele\n <\/span><\/span>critice\n <\/span><\/span>ale\n <\/span><\/span>organiza\u021biei\n <\/span><\/span>trebuie\n <\/span><\/span>monitorizat,\n <\/span><\/span>iar\n <\/span><\/span>mecanisme\ncriptografice trebuie implementate acolo unde se consider\u0103 necesar.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>ace<\/span>stui <\/span>Control\n<\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>accesul <\/span>la <\/span>distan\u021b\u0103 <\/span>la <\/span>sistemel<\/span>e <\/span>critice <\/span>nu <\/span>este <\/span>doar restric\u021bionat <\/span>\u0219i <\/span>aprobat <\/span>(conform\n<\/span>defini\u021biei <\/span>din <\/span>PR.AA-03.3), <\/span>ci <\/span>\u0219i <\/span>monitorizat <\/span>\u0219i <\/span>protejat <\/span>\u00een <\/span>mod <\/span>activ folosind mecanisme criptografice\npentru prevenirea accesul<\/span>ui ne<\/span>autorizat \u0219i compromiterea datelor. \u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea activit\u0103\u021bilor de acces la distan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>sesiunile <\/span>de <\/span>acces <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>jurnalizate, <\/span>captur\u00e2nd <\/span>identitatea <\/span>utili<\/span>zatorului,\nora, <\/span>durata <\/span>\u0219i <\/span>sistemele a<\/span>ccesate. <\/span>Instrumentele <\/span>de <\/span>monitorizare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>detecteze <\/span>tiparele de acces neobi\u0219nuite sau\nneautorizate \u0219i s\u0103 alerteze echipele de securitate \u00een timp real. Jurnalele ar\ntrebui revizuite periodic \u0219i p\u0103strate \u00een conf<\/span>ormitate\ncu politica.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea protec\u021biilor criptografice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conexiunile <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>utilizeze\n<\/span>protocoale <\/span>de <\/span>criptare <\/span>puternice, <\/span>precum <\/span>TLS,\nSSH sau securitatea protocolului de internet (IPsec). Datele transmise \u00een ti<\/span>mpul sesiunilor la distan\u021b\u0103 ar trebui\ncriptate \u00een timpul transferului. \u00cen cazul acces\u0103rii datelor sensibile, ar\ntrebui luat\u0103 \u00een considerare criptarea end-to-end (E2EE).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na regulilor de acces din PR.AA-03.3<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Set\u0103rile <\/span>de <\/span>monitorizare <\/span>\u0219i <\/span>criptare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>reflecte <\/span>restric\u021biile <\/span>de <\/span>acces <\/span>definite\n<\/span>\u00een <\/span>P<\/span>R.AA-<\/span><\/p>\n\n

 <\/span><\/p>\n\n

03.3. De exemplu,\nalertele ar trebui s\u0103 se declan\u0219eze \u00een cazul accesului \u00een afara programului sau <\/span>al <\/span>\u00eencerc\u0103rilor <\/span>de <\/span>accesare <\/span>a <\/span>sistemelor <\/span>neautorizate. T<\/span>oate <\/span>acces\u0103rile <\/span>ar <\/span>trebui <\/span>verificate \u00een raport cu aprob\u0103rile\ndocumentate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea \u00eembun\u0103t\u0103\u021birii continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>de <\/span>monitorizare <\/span>ar <\/span>trebui <\/span>utili<\/span>zate <\/span>pentru <\/span>rafinarea <\/span>politicilor <\/span>de <\/span>acces, <\/span>identificarea lacunelor \u00een punerea \u00een\naplicare \u0219i sprijinirea r\u0103spunsului la incidente. Standardele criptografice ar t<\/span>rebui re<\/span>vizuite\nperiodic pentru asigurarea alinierii la cele mai bune practici actuale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>O<\/span>T<\/span>, monitorizarea \u0219i criptarea <\/span>ar trebui implementate \u00eentr-un mod care s\u0103\nrespecte constr\u00e2ngerile <\/span>sistemului <\/span>\u0219i continuitatea <\/span>opera\u021bional\u0103. <\/span>Pentru <\/span>centralizarea <\/span>controlului <\/span>\u0219i\njurnaliz\u0103rii ar trebui utilizate servere jump sau gateway<\/span>-uri securizate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>Ghidul <\/span>tehnic <\/span>de <\/span>imp<\/span>lementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de c\u0103tre ENISA, care rec<\/span>omand\u0103 accesul securiz<\/span>at la distan\u021b\u0103, criptarea comunica\u021biilor\n\u0219i monitorizarea <\/span>continu\u0103 <\/span>ca <\/span>parte <\/span>a <\/span>managementului <\/span>eficace\n<\/span>al <\/span>riscului <\/span>de <\/span>securitate <\/span>cibernetic\u0103 pentru sistemele critice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-03.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Securitatea  <\/span><\/span>conexiunilor  <\/span><\/span>cu  <\/span><\/span>sistemele\n <\/span><\/span>externe\n <\/span><\/span>trebuie\n <\/span><\/span>verificat\u0103\n <\/span><\/span>\u0219i\n <\/span><\/span>reg<\/span>lementat\u0103  <\/span><\/span>prin  <\/span><\/span>acorduri\ndocumentate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 toate <\/span>conexiunile\ncu sistemele externe sunt securizate prin controale de securitate verificate \u0219i\nsunt guvernate de a<\/span>corduri\ndocumentate. A<\/span>ceasta reduce riscul de\nacces neautorizat, scurgerea de dat<\/span>e\n\u0219i compromiterea lan\u021bului de aprovizionare.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controlarea \u0219i documentarea tuturor <\/span>interac\u021biunilor externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>interac\u021biunile <\/span>dintre\n<\/span>sistemele <\/span>interne <\/span>\u0219i <\/span>p\u0103r\u021bile <\/span>externe\n<\/span>(de <\/span>exemplu, <\/span>v\u00e2nz\u0103torilor<\/span>, parteneri, servicii cloud) ar trebui identificate, controlate\n\u0219i documentate pentru asigurarea trasabilit\u0103\u021bii \u0219i r\u0103spunderii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea controalelor de securitate ale p\u0103r\u021bilor externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cenainte  <\/span><\/span>de  <\/span><\/span>stabilirea  <\/span><\/span>oric\u0103rei  <\/span><\/span>conexiuni,\n <\/span><\/span>postura\n <\/span><\/span>de\n <\/span><\/span>securitate\n <\/span><\/span>a\n <\/span><\/span>p\u0103r\u021bi<\/span>i  <\/span><\/span>externe  <\/span><\/span>ar  <\/span><\/span>trebui verificat\u0103 <\/span>pri<\/span>n <\/span>evalu\u0103ri, <\/span>audituri, <\/span>certific\u0103ri <\/span>(de <\/span>exemplu, <\/span>CyFun\u00ae)\n<\/span>efectuate <\/span>de <\/span>p\u0103r\u021bi\n<\/span>ter\u021be <\/span>sau prin <\/span>documenta\u021bie <\/span>tehnic\u0103, <\/span>precum <\/span>M154. <\/span>Aceste <\/span>documente\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>descrie <\/span>arhitectura de securitate, controalele de\nacces, criptarea \u0219i monitorizarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea acordurilor documentate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acordurile <\/span>formale <\/span>(de <\/span>exemplu, <\/span>contracte,\n<\/span>SLA<\/span>-uri, <\/span>acorduri <\/span>de <\/span>prelucrare\n<\/span>a <\/span>datelor <\/span>– <\/span>DP<\/span>A) ar trebui s\u0103 defineasc\u0103 cerin\u021bele de\nsecur<\/span>itate, rolurile \u0219i res<\/span>ponsabilit\u0103\u021bile, protocoalele de schimb\nde d<\/span>ate, procedu<\/span>rile de r\u0103spu<\/span>ns la incidente \u0219i condi\u021biile de reziliere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Specificarea <\/span>cerin\u021belor\nde control al accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acordurile <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>includ\u0103 <\/span>restric\u021bii <\/span>tehnice, <\/span>precum <\/span>lista\n<\/span>alb\u0103 <\/span>de <\/span>adrese\n<\/span>IP<\/span>, <\/span>RBAC, <\/span>reguli de\ngestionare a datelor \u0219i cerin\u021be de criptare pentru datele \u00een tranzit \u0219i\nstocate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i revizuirea conexiunilor externe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>conexiunile <\/span>externe\n<\/span>ar <\/span>trebui <\/span>monitorizate <\/span>con<\/span>tinuu <\/span>pentru\n<\/span>detec\u021bia <\/span>anomaliilor <\/span>sau \u00eenc\u0103lc\u0103rile <\/span>politicilor<\/span>.\nAcordurile <\/span>\u0219i <\/span>documenta\u021bia <\/span>tehnic\u0103 <\/span>(de <\/span>exemplu, <\/span>M154) <\/span>ar <\/span>trebui revizuite periodic \u0219i actualizate\natunci c\u00e2nd este necesar<\/span>. Orice\nmodificare a posturii de securitate a sistemului extern ar trebui s\u0103 declan\u0219eze\no reevaluare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea lu\u0103rii \u00een considerare a aspectelor\nspecifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>accesul\n<\/span>extern <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>fie <\/span>direc\u021bionat <\/span>prin <\/span>gateway<\/span>-uri <\/span>securizate <\/span>sau servere <\/span>jump.\nAccesul <\/span>partajat <\/span>(de <\/span>exemplu, <\/span>pentru <\/span>PLC<\/span>-urile <\/span>gestionate <\/span>de <\/span>v\u00e2nz\u0103tori) <\/span>ar trebui jurnalizat, limitat \u00een timp \u0219i <\/span>protejat prin autentificare puternic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>Ghidul <\/span>tehnic <\/span>de <\/span>implementare <\/span>privind <\/span>m\u0103suri<\/span>le <\/span>de<\/span>\nmanagement al riscului de <\/span>securitate cibernetic\u0103 elaborat de c\u0103tre\nENISA<\/span><\/span>, care recomand\u0103\nverificarea securit\u0103\u021bii p\u0103r\u021bilor ter\u021be, formalizarea responsabilit\u0103\u021bilor prin\ncontracte \u0219i monitorizarea continu\u0103 a dependen\u021belor externe.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Afirma\u021biile\nde identitate sunt protejate, t<\/span>ransmise\n\u0219i verificate<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Afirma\u021biile\nde identitate trebuie s\u0103 fie protejate, transmise \u0219i verificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>afirma\u021biile <\/span>privind\n<\/span>identitatea <\/span>– <\/span>afirma\u021bii\n<\/span>despre identitatea <\/span>unui <\/span>utilizator, <\/span>dispozitiv <\/span>sau <\/span>proces <\/span>– <\/span>sunt <\/span>protejate <\/span>\u00eempotriva\n<\/span>falsific\u0103rii, <\/span>transmise <\/span>\u00een mod securizat \u0219i verificate \u00een mod fia<\/span>bil \u00eenainte de <\/span>acordarea accesului la sisteme sau date critice. Defini\u021bie: <\/span>O <\/span>afirma\u021bie <\/span>de <\/span>identitate <\/span>este <\/span>o <\/span>declara\u021bie <\/span>digital\u0103 <\/span>utilizat\u0103 <\/span>\u00een <\/span>timpul <\/span>autentific\u0103rii <\/span>care confirm\u0103 <\/span>identitatea <\/span>unui <\/span>utilizator, <\/span>dispozitiv <\/span>sau <\/span>proces. <\/span>Aceasta\n<\/span>include <\/span>de <\/span>obicei\n<\/span>informa\u021bii precum <\/span>furnizorul <\/span>de <\/span>identitate <\/span>(IdP<\/span>), <\/span>metoda\n<\/span>de <\/span>autentificare <\/span>\u0219i <\/span>pe<\/span>rioada\n<\/span>de <\/span>valabilitate <\/span>\u0219i <\/span>este\nutilizat\u0103 pentru a acorda ac<\/span>ces la\nsisteme sau servicii.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea afirma\u021biilor de identitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Afirma\u021biile <\/span>de <\/span>identitate <\/span>ar <\/span>trebui <\/span>protejate\n<\/span>\u00eempotriva <\/span>falsific\u0103rii, <\/span>furtului\n<\/span>sau <\/span>utiliz\u0103rii <\/span>abuzive.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Ar <\/span>trebui <\/span>aplicate <\/span>criptarea\n<\/span>puternic\u0103 <\/span>(de <\/span>exemplu, TLS <\/span>1.2 <\/span>sau <\/span>o <\/span>versiune <\/span>superioar\u0103) <\/span>\u0219i semn\u0103turile <\/span>digitale. <\/span>IdP ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>Regulamentul <\/span>(UE) <\/span>nr<\/span>. <\/span>910\/2014 <\/span>al Parlamentului <\/span>European <\/span>\u0219i <\/span>al <\/span>Consiliului <\/span>din <\/span>23 <\/span>iulie <\/span>2014 <\/span>pri<\/span>vind <\/span>identificarea <\/span>elect<\/span>ronic\u0103 <\/span>\u0219i serviciile <\/span>de <\/span>\u00eencredere <\/span>pentru tranzac\u021biile <\/span>ele<\/span>ctr<\/span>onice <\/span>pe <\/span>pia\u021ba <\/span>intern\u0103 <\/span>\u0219i <\/span>de <\/span>abrogare\n<\/span>a Directivei <\/span>1999\/93\/CE, <\/span>denumit\n<\/span>\u00een <\/span>continuare <\/span>R<\/span>egulamentul <\/span>eIDAS <\/span>sau <\/span>eIDAS <\/span>(de <\/span>exemplu, itsme\u00ae, <\/span>Belgia, <\/span>Sistema <\/span>Pubblico <\/span>di <\/span>Identit\u00e0 <\/span>Dig<\/span>itale <\/span>– <\/span>SPID, Italia, <\/span>F<\/span>ranceConnect, <\/span>F<\/span>ran\u021ba).\nAceste <\/span>practici <\/span>sunt <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>recomand\u0103rile <\/span>ENISA privind <\/span>identitatea <\/span>digital\u0103 <\/span>\u0219i serviciile <\/span>de <\/span>\u00eencredere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>ransmiterea afirma\u021biilor de identitate \u00een mod securizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>de <\/span>identitate <\/span>ar <\/span>trebui <\/span>transmise <\/span>utiliz\u00e2nd <\/span>protocoale <\/span>securizate, <\/span>precum <\/span>limbaj<\/span>ul <\/span>de\nmarcare <\/span>pentru <\/span>aser\u021biuni <\/span>de <\/span>securitate <\/span>(SAML) <\/span>2.0 <\/span>sau <\/span>Open<\/span>ID <\/span>Connect.\nAr <\/span>trebui <\/span>evitat\u0103 expunerea <\/span>token-urilor\n\u00een <\/span>URL-uri; <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>anteturile <\/span>protocolu<\/span>lui <\/span>de <\/span>transfer hipertext <\/span>(HTTP) <\/span>sau <\/span>metodele\n<\/span>POST<\/span>. <\/span>Pentru <\/span>fede<\/span>ra\u021bia <\/span>transfrontalier\u0103 <\/span>a <\/span>identit\u0103\u021bilor<\/span>, <\/span>ar <\/span>trebui utilizate <\/span>noduri <\/span>eIDAS <\/span>pentru <\/span>asigurarea <\/span>interoperabilit\u0103\u021bii <\/span>securizate <\/span>\u00eentre <\/span>statele\n<\/span>membre <\/span>ale UE.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea afirma\u021biilor de <\/span>identitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>afirma\u021biile <\/span>ar <\/span>trebui <\/span>validate\n<\/span>\u00eenainte <\/span>de <\/span>acordarea\n<\/span>accesului. <\/span>Aceasta <\/span>include\n<\/span>verificarea semn\u0103turilor <\/span>digitale <\/span>utiliz\u00e2nd <\/span>autorit\u0103\u021bi <\/span>de <\/span>certificare <\/span>de <\/span>\u00eencredere <\/span>enumerate <\/span>\u00een <\/span>Lista <\/span>de<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

\u00eencredere a UE (EUTL),\nverificarea revendic\u0103rilor token <\/span>(emitent,\npublic, expirare) \u0219i validarea <\/span>\u00een <\/span>raport\n<\/span>cu <\/span>metadatele <\/span>eIDAS.\n<\/span>Prestatorii <\/span>de <\/span>servicii\n<\/span>de <\/span>\u00eencredere <\/span>califica\u021bi <\/span>(QTSP) ar trebui utiliza\u021bi pentru emiterea \u0219i verificarea\ndatelor de acce<\/span>s de identitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>afirma\u021biile <\/span>de <\/span>identitate <\/span>ar <\/span>trebui <\/span>integrate\n<\/span>\u00een <\/span>gateway<\/span>-uri <\/span>de <\/span>acces <\/span>securizate\nsau servere jump. \u00cen cazul \u00een care integrarea direct\u0103 nu este fezabil\u0103,\nverificarea identit\u0103\u021bii ar trebui s\u0103 aib\u0103 loc la nivelul stratului de\ninterfa\u021b\u0103, cu jurnalizare <\/span>\u0219i monitorizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>sus\u021binute <\/span>de <\/span>Gh<\/span>idul <\/span>tehnic <\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de <\/span>c\u0103tre\nENISA <\/span>\u0219i <\/span>de <\/span>activitatea <\/span>sa <\/span>privind <\/span>cadrele\n<\/span>de <\/span>identitate <\/span>digita<\/span>l\u0103 <\/span>securizat\u0103 <\/span>\u00een <\/span>conformitate <\/span>cu Regulamentul eIDAS \u0219i Regulamentul (UE)\n2024\/1<\/span>183 al Parlamentului Europea<\/span>n \u0219i al Consiliului <\/span>din <\/span>1<\/span>1 <\/span>aprili<\/span>e <\/span>2024 <\/span>de <\/span>modificare <\/span>a <\/span>Regulamentului <\/span>(UE) <\/span>nr<\/span>. <\/span>910\/2014 <\/span>\u00een <\/span>ceea <\/span>ce prive\u0219te instituirea cadrului european\npentru identitatea digital\u0103<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Permisiunile de acces, <\/span>drepturile \u0219i autoriza\u021biile sunt definite\n\u00eentr<\/span>-o politic\u0103, gestionate, puse \u00een\naplicare \u0219i revizuite \u0219i \u00eencorporeaz\u0103 principiile privilegiului minim \u0219i ale\nsepar\u0103rii atribu\u021biilor (SoD). PR.AA-05.1<\/b><\/span><\/p>\n\n

Permisiunile de acces,\ndrepturile \u0219i autoriza\u021biile trebuie <\/span>definite,\ngestionate, puse \u00een aplicare \u0219i revizuite.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nasigura <\/span>c\u0103 <\/span>permisiunile <\/span>de <\/span>acces, <\/span>drepturile <\/span>\u0219i <\/span>autoriza\u021biile <\/span>sunt clar\n<\/span>definite, <\/span>gestionate <\/span>corespunz\u0103tor, <\/span>puse <\/span>\u00een <\/span>aplicare\n<\/span>\u00een <\/span>mod <\/span>consecvent <\/span>\u0219<\/span>i <\/span>revizuite <\/span>periodic\n<\/span>pentru protejarea sistemelor \u0219i datel<\/span>or\n\u00eempotriva accesului neautorizat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea \u0219i managementul accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Listele <\/span>de <\/span>acces\n<\/span>pentru <\/span>sisteme <\/span>(de <\/span>exempl<\/span>u, <\/span>fi\u0219iere, <\/span>servere,\n<\/span>software, <\/span>baze <\/span>de <\/span>date) <\/span>ar <\/span>trebui\ncreate \u0219i revizuite periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirile\nar trebui s\u0103 fie sus\u021binute de instrumente precum analiza <\/span>Active Directory (AD).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile <\/span>de <\/span>management\n<\/span>al <\/span>permisiunilor <\/span>ar <\/span>trebui <\/span>documentate <\/span>\u0219i <\/span>actualizate <\/span>atunci <\/span>c\u00e2nd\neste necesar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i revocarea accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile <\/span>de <\/span>acces <\/span>logic <\/span>\u0219i <\/span>fizic <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>periodic <\/span>\u0219i <\/span>ori <\/span>de <\/span>c\u00e2te <\/span>ori <\/span>rol<\/span>urile <\/span>se modific\u0103 sau persoanele fizice p\u0103r\u0103sesc\nor<\/span>ganiza\u021bia.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Privilegiile <\/span>inutile\n<\/span>ar <\/span>trebui <\/span>revocate\n<\/span>imediat<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Practici privind conturile <\/span>de utilizator<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fiecare <\/span>utilizator<\/span>, <\/span>inclusiv <\/span>contractorii, <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>un <\/span>cont <\/span>separat\n<\/span>pentru <\/span>asigurarea\nr\u0103spunderii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acolo <\/span>unde <\/span>este <\/span>fezabil <\/span>din <\/span>punct <\/span>de <\/span>vedere <\/span>tehnic,\n<\/span>ar <\/span>trebui <\/span>aplicate\n<\/span>m\u0103s<\/span>uri <\/span>de <\/span>autentificare\nadecvate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>pentru <\/span>vizitatori <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>limitate\n<\/span>la <\/span>privilegiile <\/span>minime <\/span>necesare <\/span>(de <\/span>exemplu,\nnumai acces la internet).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>SSO\nar trebui utilizat acolo unde este cazul.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Criterii de autorizare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Deciziile  <\/span><\/span>de  <\/span><\/span>autorizare  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>ia  <\/span><\/span>\u00een  <\/span><\/span>considerare\n <\/span><\/span>caracteristici\n <\/span><\/span>precum\n <\/span><\/span>localizarea\ngeografic\u0103, ora accesului \u0219i postura de securitate <\/span>a dispozitivului solicitant.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii specifice O<\/span>T<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>medii <\/span>\u00een <\/span>care <\/span>conturile\n<\/span>individuale <\/span>nu <\/span>sunt <\/span>fezabile <\/span>din <\/span>punct <\/span>de <\/span>vedere <\/span>tehnic <\/span>– <\/span>precum accesul partajat la PLC-uri sau HMI<\/span>-uri, acce<\/span>sul\nar trebui s\u0103 fie limitat numai la func\u021biile esen\u021biale \u0219i pus \u00een aplicare prin metode\nsecuriza<\/span>te, precum un server jump\nsau un frontend HMI care jurnalizeaz\u0103 activitatea, restric\u021bioneaz\u0103 accesul \u00een\nfunc\u021bi<\/span>e de rol sau timp \u0219i adaug\u0103 un\nnivel suplimentar de autentificare (de exemplu, cartel\u0103 sau PIN).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Metodele\nde autentificare ar trebui s\u0103 fie aliniate la capabilit\u0103\u021bile sistemelor OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul\nla sistemele OT <\/span>ar trebui jurnali<\/span>zat \u0219i monitorizat, acolo unde es<\/span>te posibil.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>sta<\/span>bilit <\/span>cine <\/span>are <\/span>nevoie\n<\/span>de <\/span>acces <\/span>la <\/span>informa\u021biile <\/span>\u0219i <\/span>tehnologiile <\/span>critice\n<\/span>pentru <\/span>activitatea\norganiza\u021biei \u0219i prin ce mijloace ob\u021bine acest acces.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de\na <\/span>determina <\/span>cine <\/span>are <\/span>nevoie <\/span>de <\/span>acces <\/span>la <\/span>informa\u021biile <\/span>\u0219i <\/span>tehnologi<\/span>a critice\n<\/span>pentru <\/span>activitatea <\/span>organiza\u021biei <\/span>\u0219i <\/span>de <\/span>a <\/span>defini <\/span>mijloacele <\/span>securizate prin <\/span>care <\/span>acest <\/span>acces <\/span>este acordat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Determinarea \u0219i restric\u021bionarea accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile <\/span>de <\/span>acces <\/span>ar <\/span>trebui <\/span>limitate <\/span>doar <\/span>la <\/span>pers<\/span>oanele <\/span>fizice <\/span>care <\/span>au <\/span>nevoie <\/span>de <\/span>ele <\/span>pentru <\/span>a<\/span>– \u0219i \u00eendeplini rolurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>luat <\/span>\u00een <\/span>considerare <\/span>un <\/span>model <\/span>de <\/span>zero <\/span>trust <\/span>at\u00e2t <\/span>pentru <\/span>mediile <\/span>IT<\/span>, <\/span>c\u00e2t <\/span>\u0219i <\/span>pentru <\/span>cele<\/span><\/p>\n\n

 <\/span><\/p>\n\n

OT<\/span>, care s\u0103 necesite verificarea \u00eenainte de\nacordarea accesului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Mijloace de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Metodele <\/span>de <\/span>acces <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\n<\/span>mecanisme <\/span>securizate, <\/span>precum <\/span>chei, <\/span>parole,\n<\/span>coduri <\/span>sau privilegii\nadministrative.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste\nmetode ar trebui gestionate \u0219i monitorizate pentru preveni<\/span>rea utiliz\u0103rii abuziv<\/span>e.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>S\u0103n\u0103tatea cibernetic\u0103 a e<\/span>ndpoint<\/span>-urilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitive <\/span>precum <\/span>laptopuri, <\/span>smartphone-uri <\/span>\u0219i <\/span>tablete\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>\u00eendeplineasc\u0103 <\/span>standardele de securitate \u00eenainte de a se\nconecta la re\u021beaua de produc\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>S\u0103n\u0103tatea\nendpoint-urilor ar trebui verificat\u0103 prin:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Software <\/span>antivirus <\/span>actualizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Absen\u021ba\nmalware-ului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Instalarea\ncelor mai recente patch-uri <\/span>de\nsecuritate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Numai\ndispozitivele conforme ar trebui s\u0103 aib\u0103 acces la sistemele \u0219i datele critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii specifice O<\/span>T<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen\nmediile OT<\/span>, accesul la sistemele de\ncontrol ar trebui limitat la personalul esen\u021bial.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Metodele <\/span>de <\/span>acces <\/span>securizate <\/span>(de <\/span>exemplu, <\/span>servere\n<\/span>jump, <\/span>restric\u021bii <\/span>bazate <\/span>pe <\/span>roluri)\n<\/span>ar <\/span>trebui utilizate \u00een cazul\n\u00een care conturil<\/span>e individuale nu sunt\nfezabile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Referin\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>instrumente <\/span>\u0219i <\/span>\u0219abloane <\/span>practice,\n<\/span>consulta\u021bi <\/span>\u0219ablonul <\/span>de <\/span>Politic\u0103 <\/span>de <\/span>acces <\/span>din <\/span>S<\/span>etul <\/span>de<\/span> instrumente CyFun\u00ae\npe www<\/span>.cyfun.eu.<\/span><\/a><\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Drepturile <\/span>de <\/span>acces, <\/span>privilegiile <\/span>\u0219i <\/span>autoriza\u021bii<\/span>le <\/span>trebuie <\/span>res<\/span>tric\u021bionate <\/span>la <\/span>sistemele <\/span>\u0219i <\/span>informa\u021biile\nspecifice necesare pentr<\/span>u \u00eendeplinire<\/span>a sarcinilor (principiul privilegiului\nminim).<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura restric\u021bionare<\/span>a\ndrepturilor de acces, privilegiilor \u0219i autoriza\u021biilor numai la sistemele \u0219i\ninforma\u021biile specifice necesare pentru \u00eendeplinirea sarcinilor atribuite,\nrespect\u00e2nd principiul privilegiului minim.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea principiului privilegiului minim<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile <\/span>de <\/span>acces <\/span>ar <\/span>trebui <\/span>limitate\n<\/span>la <\/span>minimul <\/span>necesar\n<\/span>pentru <\/span>utilizatori, <\/span>sisteme\n<\/span>\u0219i <\/span>servicii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>\u00eenceap\u0103 <\/span>cu <\/span>privilegii <\/span>reduse\n<\/span>\u0219i <\/span>s\u0103 <\/span>fie <\/span>ridicate <\/span>doar <\/span>atunci <\/span>c\u00e2nd <\/span>este\njustificat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul\nJIT <\/span>ar trebui utilizat pentru\nlimitarea dur<\/span>atei privilegiilor\nridicate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea \u0219i gestionarea permisiunilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile\nde acces ar tr<\/span>ebui definite clar \u00een\nfunc\u021bie de roluri \u0219i responsabilit\u0103\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un\ninventar al conturilor \u0219i permisiunilor asociate ar trebui men\u021binut \u0219i\nactualizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>utilizate  <\/span><\/span>conturi\n <\/span><\/span>separate\n <\/span><\/span>pentru\n <\/span><\/span>contractori\n <\/span><\/span>\u0219i\n <\/span><\/span>p\u0103r\u021bi\n <\/span><\/span>ter\u021be,\n <\/span><\/span>pentru\n <\/span><\/span>asigurarea\ntrasabilit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na controalelor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modelele <\/span>de <\/span>control\n<\/span>al <\/span>accesului <\/span>bazate <\/span>pe <\/span>roluri <\/span>sau <\/span>atribute\n<\/span>ar <\/span>trebui <\/span>implementate <\/span>acolo unde este fezabil.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Punctele\nde acces la internet \u0219i conexiunile externe ar trebui limitate la strictul\nnecesar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cent\u0103rirea sistemelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele\nar trebui \u00eent\u0103rite pentru a sprijini controlul accesului prin:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Dezactivarea\nporturilor \u0219i serviciilor neutilizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Restric\u021biona<\/span>rea Bluetooth-ului acolo unde nu este\nnecesar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Limitarea <\/span>protocoalelor <\/span>vechi, <\/span>precum <\/span>protocol\n<\/span>de <\/span>transfer <\/span>de <\/span>fi\u0219iere <\/span>(FTP), <\/span>cu <\/span>excep\u021bia cazului \u00een care sunt configurate\n\u00een mod securizat.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i adaptarea accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile <\/span>de <\/span>acces <\/span>ar <\/span>tr<\/span>ebui <\/span>revizuite\n<\/span>periodic <\/span>\u0219i <\/span>ajustate\n<\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>modific\u0103rile <\/span>de <\/span>rol,\nfinalizarea proiectelor sau evalu\u0103rile <\/span>de\nsecuritate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul\nar trebui revocat imediat c\u00e2nd nu mai este necesar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii specifice O<\/span>T<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>controlul\n<\/span>accesului <\/span>ar <\/span>trebu<\/span>i <\/span>s\u0103 <\/span>respecte <\/span>\u00een <\/span>continuare <\/span>principiul\n<\/span>priv<\/span>ilegiului minim. \u00cen cazul\n\u00een care exist\u0103 limit\u0103ri tehnice, ar trebui aplicate m\u0103surile de control al\naccesului <\/span>O<\/span>T definite <\/span>anterior <\/span>(a <\/span>se <\/span>vedea <\/span>PR.AA<\/span>-01.1 <\/span>\u0219i <\/span>PR.AA-05.1) <\/span>pentru <\/span>a <\/span>asigura <\/span>un\nacces securizat \u0219i trasabil.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Nimeni\nnu trebuie s\u0103 aib\u0103 privilegii administrative pentru sarcinile de rutin\u0103,\nzilnice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>preveni <\/span>utilizarea <\/span>privilegiilor administrative <\/span>pentru <\/span>sarcinile de rutin\u0103, zilnice, reduc<\/span>\u00e2nd astfel riscul de utilizare abuziv\u0103 sau\nexploatare de c\u0103tre atacatori.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Separarea <\/span>conturilor <\/span>\u0219i <\/span>gestionarea <\/span>privilegiilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile\nad<\/span>ministrative \u0219i cele ale utilizator<\/span>ilor obi\u0219nui\u021bi ar trebui separate strict.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>dedicate <\/span>de <\/span>administrator <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>numai <\/span>pentru <\/span>gestionarea <\/span>sistemului <\/span>\u0219i\nsarcinile administrative.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile\nutilizatorilor nu ar trebui s\u0103 aib\u0103 privilegii administrative.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Restric\u021bii de acces \u0219i m\u0103suri de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui create parole locale unice de administrator pentru fi<\/span>ecare sistem.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile\nne<\/span>utilizate ar trebui dezactivate\nimediat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Navigarea <\/span>pe <\/span>internet\n<\/span>de <\/span>pe <\/span>conturile <\/span>administrative <\/span>ar <\/span>trebui <\/span>interzis\u0103\n<\/span>pentru <\/span>a <\/span>reduce expunerea la amenin\u021b\u0103ri din mediul\nweb.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii specifice O<\/span>T<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen\nmediile OT<\/span>, accesul administrati<\/span>v ar trebui limitat la personalul \u0219i\nfunc\u021biile esen\u021biale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>cazul <\/span>\u00een <\/span>care <\/span>este <\/span>necesar <\/span>acces<\/span>ul <\/span>partajat,\n<\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>metode <\/span>de <\/span>acces <\/span>securiz<\/span>at <\/span>(de\nexemplu, servere jump, jurnalizarea sesiunilor) pentru asigurarea r\u0103spunderii\n\u0219i reducerea riscului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acolo unde este fezabil din punct de\nvedere tehnic, opera\u021bional \u0219i economic <\/span>–\nf\u0103r\u0103 a compromite integritatea, siguran\u021ba sau conformitatea sist<\/span>emului – trebuie implementate mecanisme\nautomatizate pentru gestionarea conturilor de utilizator pe sistemele critice T<\/span>IC \u0219i OT. Fezabilitatea trebuie\ndeterminat\u0103 pe baza capabilit\u0103\u021bilor sistemului, poten\u021b<\/span>ialului de integrare, evalu\u0103rii riscurilor \u0219i impactului asupra\nactivit\u0103\u021bii.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de\na <\/span>asigura c\u0103 <\/span>conturile <\/span>utilizatorilor <\/span>pe <\/span>sistemele <\/span>critice <\/span>TIC <\/span>\u0219i <\/span>OT\nsunt gestionate \u00een mod securizat, eficient \u0219i consecvent prin mecanisme\nautomatizate <\/span>– acolo unde este fezabil\ndin punct de vedere tehnic, opera\u021bional \u0219i economic <\/span>– f\u0103r\u0103 a compromite integritatea, siguran\u021ba sau conformitatea\nsistemului.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea fezabilit\u0103\u021bii automatiz\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Fezabilitatea <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>fie <\/span>bazat\u0103 <\/span>pe <\/span>capabilit\u0103\u021bile <\/span>sistemului, <\/span>poten\u021bialul <\/span>de <\/span>integrare,\nevaluarea riscurilor \u0219i impactul asupra activit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Pentru <\/span>sistemele TIC, <\/span>fezabilitatea <\/span>depinde <\/span>de <\/span>disponibilitatea <\/span>instrumentelor <\/span>de automatizare, <\/span>API-urilor <\/span>sau <\/span>op\u021biunilor <\/span>de <\/span>integrare <\/span>\u0219i <\/span>de <\/span>absen\u021ba\n<\/span>unor <\/span>obstacole <\/span>tehnice sau financiare majore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Pentru  <\/span>sistemele \n<\/span>OT<\/span>,  <\/span>fezabilitatea \n<\/span>depinde  <\/span>de  <\/span>vechimea \n<\/span>sistemului,  <\/span>de  <\/span>limit\u0103rile v\u00e2nz\u0103torului, de cerin\u021bele de\nsiguran\u021b\u0103 \u0219i de riscul de \u00eentrerupere a opera\u021biunilor criti<\/span>ce.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Fezabilitatea\ngeneral\u0103 ar trebui s\u0103 ia \u00een considerare capabilitatea tehnic\u0103, siguran\u021ba\nopera\u021bional\u0103<\/span>, rentabilitatea \u0219i\nconformita<\/span>tea cu standardele de\nsecuritate \u0219i de reglementare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea gestion\u0103rii ciclului de via\u021b\u0103 al\nconturilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mecanismele <\/span>automate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>gestioneze <\/span>crearea, <\/span>modificarea <\/span>\u0219i <\/span>\u0219ter<\/span>gerea <\/span>conturilor <\/span>pe baza <\/span>unor <\/span>reguli <\/span>predefinite.\nAceasta <\/span>asigur\u0103 <\/span>c\u0103 <\/span>numai <\/span>ut<\/span>ili<\/span>zatorii\n<\/span>autoriza\u021bi <\/span>au <\/span>acces <\/span>\u0219i <\/span>c\u0103 conturile sunt \u0219terse imediat <\/span>c\u00e2nd nu mai sunt necesare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dezactivarea conturilor inactive sau neautorizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>ar <\/span>trebui <\/span>dezactivate <\/span>automat\n<\/span>atunci <\/span>c\u00e2nd <\/span>utilizatorii <\/span>p\u0103r\u0103sesc <\/span>or<\/span>ganiza\u021bia\n<\/span>sau <\/span>nu <\/span>mai au nevoie de acces. <\/span>Aceasta\nreduce riscul accesului neautorizat la sisteme critice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i raportarea activit\u0103\u021bii conturilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>automate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>monitorizeze <\/span>continuu\n<\/span>utilizarea <\/span>contului <\/span>\u0219i <\/span>s\u0103 <\/span>genereze rapoarte <\/span>pentru <\/span>a <\/span>detecta\n<\/span>activit\u0103\u021bi <\/span>neobi\u0219nuite <\/span>sau <\/span>neautoriz<\/span>ate. Ar\n<\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>declan\u0219ate\nalerte \u00een cazul unor comportamente suspecte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>rimiterea de notific<\/span>\u0103ri pentru\nevenimente cheie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Notific\u0103rile  <\/span><\/span>automate  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>informeze\n <\/span><\/span>administratorii\n <\/span><\/span>cu\n <\/span><\/span>pri<\/span>vire  <\/span><\/span>la  <\/span><\/span>evenimente importante, <\/span>precum\n<\/span>crearea, <\/span>modific<\/span>area <\/span>sau <\/span>\u0219ter<\/span>gerea <\/span>conturilor<\/span>, <\/span>permi\u021b\u00e2nd <\/span>supravegherea <\/span>\u00een timp util.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea pistelor de audit pentru co<\/span>nformitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>activit\u0103\u021bile <\/span>legate\n<\/span>de <\/span>conturi <\/span>ar <\/span>trebui <\/span>jurnalizate <\/span>automat <\/span>pentru <\/span>a <\/span>sprijini <\/span>conformitatea cu politicile interne \u0219i\nreglement\u0103rile externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>automatizarea <\/span>ar <\/span>trebui <\/span>implementat\u0103 <\/span>doar <\/span>\u00een <\/span>cazul\n<\/span>\u00een <\/span>care <\/span>nu <\/span>compromite\nsiguran\u021ba <\/span>sau <\/span>continuitatea <\/span>opera\u021bional\u0103.\n\u00cen <\/span>cazul <\/span>\u00een <\/span>care automatizarea <\/span>direct\u0103\n<\/span>nu <\/span>este fezabil\u0103, <\/span>managementul <\/span>conturilor a<\/span>r <\/span>trebui <\/span>realizat <\/span>prin <\/span>intermediul <\/span>unor <\/span>straturi <\/span>de <\/span>interfa\u021b\u0103\nsecurizate sau servere jump.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>sus\u021binute <\/span>de <\/span>Gh<\/span>idul <\/span>tehnic <\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de <\/span>c\u0103tre\nENISA \u0219i <\/span>de <\/span>activitatea <\/span>sa <\/span>privind\n<\/span>managementul <\/span>accesului <\/span>securizat\n<\/span>\u00een <\/span>mediile <\/span>de infrastructur\u0103 critic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.6<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

SoD trebuie asigurat\u0103 \u00een managementul drepturilo<\/span>r de acces.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 nicio persoan\u0103 fizic\u0103 nu de\u021bine control deplin\nasupra sistemelor <\/span>sau <\/span>proceselor <\/span>critice, <\/span>prin <\/span>aplicarea\n<\/span>So<\/span>D. <\/span>Aceasta <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>reduc\u0103 <\/span>ri<\/span>scul <\/span>de <\/span>erori, <\/span>fraud\u0103 \u0219i utilizarea abuziv\u0103 a <\/span>drepturilor de <\/span>acces.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea separ\u0103rii atribu\u021biilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Responsabilit\u0103\u021bile\nar trebui \u00eemp\u0103r\u021bite astfel \u00eenc\u00e2t sarcinile cheie s\u0103 <\/span>fie \u00eendeplinite de persoane fizice diferite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>SoD\nar trebui s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Rolurile <\/span>opera\u021bionale <\/span>\u0219i <\/span>de <\/span>asisten\u021b\u0103 <\/span>pentru <\/span>sisteme <\/span>ar <\/span>trebui <\/span>atribuite <\/span>unor <\/span>persoane <\/span>fi<\/span>zice\ndiferite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sarcinile\nde asisten\u021b\u0103 sistemic\u0103 ar trebui s\u0103 necesite supraveghere sau <\/span>control dublu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>O\nsingur\u0103 persoan\u0103 nu ar trebui s\u0103 ini\u021bieze \u0219i s\u0103 aprobe aceea\u0219i tranzac\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Func\u021biile\nde control al accesului \u0219i de audit ar trebui gestionate <\/span>de roluri separate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Gestionarea drepturilor de acces \u00een mod adecvat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>RBAC\nar trebui utilizat pentr<\/span>u atribuirea\npermisiunilor \u00een func\u021bie de rolurile profesionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Principiul <\/span>privilegiului <\/span>minim <\/span>ar <\/span>trebui <\/span>aplicat <\/span>pentru <\/span>limitarea <\/span>accesului\n<\/span>la <\/span>ceea <\/span>ce <\/span>este <\/span>strict necesar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile <\/span>de <\/span>acces <\/span>ar <\/span>trebui <\/span>revizuite <\/span>periodic,\n<\/span>\u00een <\/span>special <\/span>pentru <\/span>sistemele <\/span>critic<\/span>e <\/span>\u0219i <\/span>rolurile\ncu <\/span>risc <\/span>ridicat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acolo  <\/span><\/span>unde  <\/span><\/span>este  <\/span><\/span>fezabil,\n <\/span><\/span>pentru\n <\/span><\/span>func\u021biile\n <\/span><\/span>administrative\n <\/span><\/span>\u0219i\n <\/span><\/span>de\n <\/span><\/span>audit\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>utilizate\ninstrumente sau conturi separate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea controalelor pentru ad<\/span>ministratorii de sistem<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Responsabilit\u0103\u021bile <\/span>administrative <\/span>ar <\/span>trebui <\/span>\u00eem<\/span>p\u0103r\u021bite <\/span>pentru <\/span>\u00eempiedicarea <\/span>controlului <\/span>total <\/span>de c\u0103tre o\nsingur\u0103 persoan\u0103 fizic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Administratorii\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>utiliz<\/span>eze  <\/span><\/span>conturi  <\/span><\/span>separ<\/span>ate  <\/span><\/span>pentru  <\/span><\/span>sarcinile  <\/span><\/span>obi\u0219nuite\n <\/span><\/span>\u0219i\n <\/span><\/span>cele\nprivilegiate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate ac\u021biunile\nadministrative ar trebui jurnalizate \u0219i revizuite de <\/span>o parte independent\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Administratorii <\/span>care <\/span>gestioneaz\u0103 <\/span>accesul <\/span>nu <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>responsabili <\/span>pentru <\/span>auditarea\nacestui acces.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii \u00een mediile O<\/span>T<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen\nsistemele OT<\/span>, SoD ar trebui adaptat\u0103\nla constr\u00e2ngerile opera\u021bionale \u0219i de <\/span>siguran\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen  <\/span><\/span>cazul  <\/span><\/span>\u00een  <\/span><\/span>care  <\/span><\/span>separarea  <\/span><\/span>complet\u0103  <\/span><\/span>nu  <\/span><\/span>este  <\/span><\/span>fezabil\u0103,\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>implementate\n <\/span><\/span>controale\ncompensatorii, precum aprobarea du<\/span>bl\u0103,\njurnalizarea \u0219i revizuirea extern\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>aliniate <\/span>cu <\/span>M\u0103surile <\/span>de <\/span>securitate <\/span>pentru <\/span>operatorii <\/span>de <\/span>servicii <\/span>esen\u021biale (Reference document on security\nmeasures for Operators of Essential Services\n<\/span>CG Publication <\/span>01\/2018) <\/span>elaborate\n<\/span>de <\/span>c\u0103tre <\/span>ENISA, <\/span>care <\/span>subliniaz\u0103 <\/span>importan\u021ba <\/span>SoD <\/span>\u0219i <\/span>a <\/span>RBAC \u00een reducerea riscurilor legate de\nacces \u00een <\/span>mediile <\/span>TIC \u0219i OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.7<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Utilizatorii cu drepturi privilegiate trebuie\ngestiona\u021bi \u0219i monitoriza\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>riscul <\/span>de <\/span>acces <\/span>neautorizat, <\/span>\u00eenc\u0103lc\u0103ri\n<\/span>ale <\/span>securit\u0103\u021bii <\/span>datelor \u0219i \u00eentreruperi opera\u021bionale,\nasigur\u00e2ndu<\/span>-se c\u0103 utilizatorii cu drepturi\npri<\/span>vilegiate, care au acces ridicat\nla sisteme critice, sunt su<\/span>pu\u0219i unei\nge<\/span>stion\u0103ri stricte \u0219i unei su<\/span>pravegheri continue.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een consid<\/span>erare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea activit\u0103\u021bilor privilegiate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Activit\u0103\u021bile <\/span>utilizatorilor <\/span>cu <\/span>drepturi <\/span>privilegiate <\/span>ar <\/span>trebui <\/span>jurnalizate <\/span>\u0219i <\/span>revizuite <\/span>periodic <\/span>sau\ncontinuu, chiar dac\u0103 sunt efectuate de persoane fizice care <\/span>nu sunt independente de proces.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea datelor sensibile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>contribuie  <\/span><\/span>la  <\/span><\/span>prevenirea\n <\/span><\/span>expunerii\n <\/span><\/span>sau\n <\/span><\/span>utiliz\u0103rii\n <\/span><\/span>abuzive\n <\/span><\/span>a\ninforma\u021biilor sensibile \u0219i a configura\u021biilor de sistem de c\u0103tre utilizatorii cu\ndrepturi privilegiate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Prevenirea abuzului de privilegii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>privilegiate <\/span>ar <\/span>trebui <\/span>gestionate <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>fie <\/span>evitate\n<\/span>modific\u0103rile <\/span>neautorizate,\nescaladarea privilegiilor sau ocolirea controalelor de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Detec\u021bia comportamentului suspect<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Anomaliile <\/span>comportamentale <\/span>\u0219i <\/span>ac\u021biunile <\/span>neautorizate <\/span>ar <\/span>trebui <\/span>identificate <\/span>prin <\/span>mecanisme\nautomate de jurnalizare \u0219i alertare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea r\u0103spunsului la incidente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>de <\/span>monitorizare <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>pentru <\/span>a <\/span>investiga\n<\/span>\u0219i <\/span>a <\/span>r\u0103spunde <\/span>la <\/span>incidentele <\/span>de securitate care implic\u0103 conturi privilegiate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Gestionarea proactiv\u0103 a drepturilor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Drepturile  <\/span><\/span>de  <\/span><\/span>acces  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>definite  <\/span><\/span>clar<\/span>,  <\/span><\/span>revizuite  <\/span><\/span>periodic  <\/span><\/span>\u0219i  <\/span><\/span>ajustate\n <\/span><\/span>\u00een\n <\/span><\/span>func\u021bie\n <\/span><\/span>de\nmodific\u0103rile <\/span>de roluri, necesit\u0103\u021bile opera\u021bionale\nsau evalu\u0103rile <\/span>riscurilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>acce<\/span>sul <\/span>privilegiat <\/span>ar <\/span>trebui <\/span>gestionat\n<\/span>\u021bin\u00e2nd <\/span>cont <\/span>de <\/span>stabilitatea <\/span>\u0219i <\/span>siguran\u021ba\nsistemului. \u00cen cazul \u00een care monitori<\/span>zarea\ncomplet\u0103 nu este fezabil\u0103, ar tr<\/span>ebui\nimplementate controale compensatorii, <\/span>precum\njurnalizarea la nivel de interfa\u021b\u0103<\/span><\/span>1 <\/span><\/span>sau reviz<\/span>uirea extern\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

<\/span><\/span>o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>aliniate\n<\/span>cu <\/span>Ghidul <\/span>tehnic\n<\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de <\/span>c\u0103tre\nENISA, care subliniaz\u0103 importan<\/span>\u021ba\ncontrolului \u0219i monitoriz\u0103rii accesului privilegiat \u00een securizarea serviciilor\nesen\u021biale \u0219i a infrastructurilor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

1 <\/span><\/span>Jurnalizarea <\/span>la\nnivel de i<\/span>nterfa\u021b\u0103 \u00eenseam<\/span>n\u0103 \u00ee<\/span>nre<\/span>gistrarea <\/span>ac\u021b<\/span>iunilor <\/span>utilizatorilo<\/span>r \u00een <\/span>mome<\/span>ntul \u00een care se conecteaz\u0103 <\/span>la un sistem, de e<\/span>xemplu prin i<\/span>nt<\/span>ermedi<\/span>ul\nunui instrument <\/span>de acces la dista<\/span>n\u021b\u0103, al unui serve<\/span>r ju<\/span>mp sau al unui <\/span>gatewa<\/span>y\nsecurizat, f\u0103<\/span>r\u0103 a fi necesar\u0103 jurnalizarea <\/span>dire<\/span>ct\u0103\n\u00een interi<\/span>orul sistemului (de\nexemplu, utiliz\u00e2nd Spl<\/span>unk\u00ae). Aceasta\ncont<\/span>ribuie la m<\/span>onitorizarea <\/span>ac<\/span>tivit\u0103\u021b<\/span>ilor\npri<\/span>vilegiate \u00een medii <\/span>\u00een ca<\/span>re\njurnalizarea direct\u0103 \u00een sistem nu e<\/span>ste\nposi<\/span>bil\u0103, prec<\/span>um \u00een siste<\/span>mele OT<\/span>.<\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.8<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Restric\u021biile <\/span>de <\/span>utilizare <\/span>a <\/span>conturilor <\/span>pentru\n<\/span>anumite <\/span>perioade <\/span>de <\/span>timp <\/span>\u0219i <\/span>loca\u021bii <\/span>trebuie\n<\/span>luate <\/span>\u00een considerare \u00een\npolitica de securitate a accesului organiza\u021biei \u0219i aplicate \u00een consecin\u021b\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>ri<\/span>scul <\/span>accesului\n<\/span>neautorizat, <\/span>asigur\u00e2nd c\u0103 <\/span>utilizarea contului este restric\u021bionat\u0103 \u00een\nfunc\u021bi<\/span>e de timp, loca\u021bie, dispozitiv\n\u0219i contextul utiliz<\/span>atorului. Ac<\/span>este restric\u021bii ar trebui definite \u00een\npolitic<\/span>a de securitate a accesului organiza\u021biei\n\u0219i aplicate \u00een mod consecvent \u00een mediile TIC \u0219i OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea restric\u021biilor bazate pe timp<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>la <\/span>sisteme <\/span>ar <\/span>trebui <\/span>limitat <\/span>la <\/span>programul\n<\/span>de <\/span>lucru <\/span>stabilit, <\/span>pentru <\/span>a <\/span>reduce <\/span>expunerea \u00een afara programului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Durata <\/span>de <\/span>utilizare\n<\/span>a <\/span>anumitor <\/span>conturi <\/span>ar <\/span>trebui <\/span>limitat\u0103 <\/span>pentru <\/span>a <\/span>preveni <\/span>sesiunile <\/span>excesive sau nesupravegheate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea restric\u021biilor bazate pe loca\u021bie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Geofencing  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>utilizat  <\/span><\/span>pentru\n <\/span><\/span>a\n <\/span><\/span>permit<\/span>e  <\/span><\/span>accesul  <\/span><\/span>numai  <\/span><\/span>din  <\/span><\/span>loca\u021bii\n <\/span><\/span>geografice\n <\/span><\/span>de\n\u00eencredere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Filtrarea <\/span>adreselor\n<\/span>IP <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>restric\u021bioneze <\/span>accesul <\/span>la <\/span>intervale\n<\/span>de <\/span>re\u021bea <\/span>cunoscute\n<\/span>\u0219i aprobate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea restric\u021biilor bazate pe dispozitiv<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>ar <\/span>trebui <\/span>permis <\/span>numai <\/span>de <\/span>pe <\/span>dispozitive <\/span>gestionate <\/span>care <\/span>respect\u0103\n<\/span>politicile <\/span>de securitate ale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitivele <\/span>negestionate <\/span>ar <\/span>trebui <\/span>restric\u021bionate <\/span>sau <\/span>ar <\/span>trebui <\/span>acordat <\/span>acces <\/span>li<\/span>mitat <\/span>(de\nexemplu, acces numai pentru citire sau f\u0103r\u0103 acces la date sensibile).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea restric\u021biilor bazate pe utilizator<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>RBAC <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>asigure\n<\/span>c\u0103 <\/span>utilizatorii <\/span>acceseaz\u0103\n<\/span>numai <\/span>sistemele <\/span>\u0219i <\/span>datele <\/span>relevante\n<\/span>pentru activitatea <\/span>lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politicile <\/span>de <\/span>acces <\/span>condi\u021bionat <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>impun\u0103 <\/span>verific\u0103ri <\/span>suplimentare <\/span>(de <\/span>exemplu,\n<\/span>MF<\/span>A)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00een scenarii cu risc ridicat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluare <\/span>continu\u0103 <\/span>\u0219i <\/span>adaptiv\u0103 <\/span>a <\/span>ri<\/span>scului <\/span>\u0219i <\/span>\u00eencrederii\n<\/span>(CAR<\/span>T<\/span>A) <\/span>ar <\/span>trebui <\/span>luat\u0103 <\/span>\u00een <\/span>considerare\npentru <\/span>evaluarea <\/span>\u00een <\/span>mod <\/span>dinamic\n<\/span>a <\/span>\u00eencrederii <\/span>utili<\/span>zatorilor <\/span>\u0219i <\/span>a <\/span>dispozitivelor<\/span>. <\/span>Aceast\u0103 <\/span>abordare<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

este\n<\/span>aliniat\u0103 <\/span>cu <\/span>principiul\n<\/span>zero <\/span>trust, <\/span>care <\/span>pre<\/span>supune <\/span>c\u0103 <\/span>nu <\/span>exist\u0103 <\/span>\u00eencredere\n<\/span>implicit\u0103 <\/span>pentru niciun\nutilizator sau dispozitiv<\/span>, chiar \u0219i\n\u00een interiorul re\u021belei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>restric\u021biile <\/span>ar <\/span>trebui <\/span>adaptate <\/span>la <\/span>cerin\u021bele\n<\/span>opera\u021bionale <\/span>\u0219i <\/span>de <\/span>siguran\u021b\u0103. <\/span>\u00cen <\/span>cazul\n\u00een <\/span>care <\/span>exist\u0103 <\/span>limit\u0103ri <\/span>tehnice,\n<\/span>ar <\/span>trebui <\/span>implementate <\/span>controale <\/span>compensatorii,\nprecum restric\u021bii de acces fizic sau servere jump monitorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>aliniate <\/span>cu <\/span>Ghidul <\/span>tehnic\n<\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de <\/span>c<\/span>\u0103tre ENISA, <\/span>care <\/span>sus\u021bine <\/span>controlul\n<\/span>contextual <\/span>al <\/span>accesului\n<\/span>ca <\/span>parte <\/span>a <\/span>managementului\neficace <\/span>al riscului de securitate\ncibernetic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-05.9<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Utilizatorii cu drepturi privilegiate trebuie\ngestiona\u021bi, monitoriza\u021bi \u0219i audita\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 conturile de utilizator cu d<\/span>repturi\nprivilegiate, cele c<\/span>u acces ridicat <\/span>la <\/span>sisteme <\/span>critice, <\/span>sunt <\/span>strict <\/span>controlate, <\/span>monitorizate <\/span>continuu <\/span>\u0219i <\/span>auditate <\/span>independent.\nAceasta ar trebui s\u0103 reduc\u0103 risc<\/span>ul de\nutilizare abu<\/span>ziv\u0103, s\u0103 asigure r\u0103spund<\/span>erea \u0219i s\u0103 protejeze mediile critice IT,\nOT \u0219i IoT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na unui management strict al accesului pri<\/span>vilegiat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conturile <\/span>privilegiate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>roluri <\/span>clar <\/span>definite,\n<\/span>domenii <\/span>de <\/span>acces <\/span>limitate <\/span>\u0219i <\/span>s\u0103 <\/span>fie supuse unor revizuiri periodice ale\naccesului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea monitoriz\u0103rii continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>activit\u0103\u021bile <\/span>utilizatorilor <\/span>cu <\/span>drepturi <\/span>privilegiate <\/span>ar <\/span>trebui <\/span>jurnalizate <\/span>\u0219i <\/span>monitorizate\ncontinuu, utiliz\u00e2nd instrumente automatizate acolo unde este posibil, pentru a\nsprijini trasabilitatea \u0219i r\u0103spunsul la incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Efectuarea de audituri independente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Auditurile <\/span>ar <\/span>trebui <\/span>efectuate <\/span>periodic\n<\/span>de <\/span>c\u0103tre <\/span>persoane\n<\/span>fizice <\/span>independente <\/span>de <\/span>proc<\/span>esul <\/span>de\nmanagement al accesului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Auditurile\nar trebui s\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>V<\/span>erifice dac\u0103 accesul privilegiat este\nacordat \u00een conformitate cu politica.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Confirme\nc\u0103 mecanismele de monitorizare \u0219i <\/span>jurnalizare\nfunc\u021bioneaz\u0103 corect.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Identifice\nutilizarea abuziv\u0103, \u00eenc\u0103lc\u0103rile politicilor sau abaterile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Produc\u0103 <\/span>rez<\/span>ultate <\/span>documentate, <\/span>precum <\/span>rapoarte <\/span>de <\/span>audit <\/span>sau <\/span>planuri <\/span>de <\/span>ac\u021biuni <\/span>corective.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea principiului celor patru ochi<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Nicio <\/span>persoan\u0103 <\/span>fizic\u0103 <\/span>nu <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>poat\u0103 <\/span>acorda,\n<\/span>modifica <\/span>sau <\/span>revoca <\/span>accesul <\/span>pr<\/span>ivilegiat <\/span>f\u0103r\u0103 supravegherea sau aprobarea unei alte\npersoane autorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Diferen\u021bierea \u00eentre monitorizare \u0219i audit<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea <\/span>zilnic\u0103 <\/span>a <\/span>conformit\u0103\u021bii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>se <\/span>concentreze <\/span>pe <\/span>aspecte <\/span>opera\u021bionale <\/span>(de exemplu, alerte, anomalii).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Auditurile <\/span>periodice <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>evalueze <\/span>eficacitatea <\/span>\u0219i <\/span>integritatea <\/span>general\u0103\n<\/span>a <\/span>procesului <\/span>de management al accesului privilegiat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen  <\/span><\/span>mediile  <\/span><\/span>OT<\/span>,  <\/span><\/span>controalele  <\/span><\/span>accesului  <\/span><\/span>privilegiat\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>adaptate\n <\/span><\/span>la\n <\/span><\/span>constr\u00e2ngerile\nopera\u021bionale \u0219i <\/span>de <\/span>siguran\u021b\u0103. <\/span>\u00cen <\/span>cazul <\/span>\u00een <\/span>care <\/span>auditul\n<\/span>complet <\/span>nu <\/span>este <\/span>fezabil, <\/span>ar <\/span>trebui\nimplementate <\/span>controale <\/span>compensatorii, <\/span>precum <\/span>jurnalizarea <\/span>la <\/span>nivel <\/span>de <\/span>interfa\u021b\u0103 <\/span>sau <\/span>revizuirea\nextern\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>aliniate <\/span>cu <\/span>Ghidul <\/span>tehnic <\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de c\u0103tre ENIS<\/span>A, care subliniaz\u0103 im<\/span>portan\u021ba\ncontrolului accesulu<\/span>i privilegiat, a\nmonitoriz\u0103rii \u0219i a auditului \u00een securizarea serviciilor esen\u021biale \u0219i a\ninfrastructurii critice.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Accesul <\/span>fizic <\/span>la <\/span>activele\n<\/span>organiza\u021biei <\/span>este <\/span>gestionat, <\/span>monitoriza<\/span>t <\/span>\u0219i <\/span>pus <\/span>\u00een <\/span>aplicare <\/span>\u00een <\/span>mod <\/span>propor\u021bion<\/span>al cu riscul.<\/span><\/p>\n\n

PR.AA-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Accesul <\/span>fizic <\/span>la <\/span>toate <\/span>activele <\/span>organiza\u021biei, <\/span>inclusiv <\/span>zonele <\/span>critice,\n<\/span>trebuie <\/span>gestionat, <\/span>monitorizat <\/span>\u0219i implementat \u00een func\u021bie de risc.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>gestionarea, <\/span>monitorizarea <\/span>\u0219i <\/span>punerea\n\u00een <\/span>aplicare \u00een func\u021bie <\/span>de <\/span>riscuri <\/span>a <\/span>accesului <\/span>fizic <\/span>la <\/span>toate <\/span>activele <\/span>organiza\u021biei, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>zonele <\/span>critice,\n<\/span>pentru a preveni intrarea neautorizat\u0103 \u0219i a pr<\/span>oteja sistemele sensibile.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>M\u0103suri de control al accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cheile,\ncartelele \u0219i codurile de alarm\u0103 ar trebui gestionate cu stricte\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele\nde acces ale angaja\u021bilor ar trebui colectate imediat dup\u0103 plecare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Codurile\nde alarm\u0103 ar tre<\/span>bui modificate\nperiodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Furnizorii <\/span>externi <\/span>de <\/span>servicii <\/span>(de <\/span>exemplu, <\/span>personalul <\/span>de <\/span>cur\u0103\u021benie) <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>aib\u0103 <\/span>acces numai atunci c\u00e2nd este necesar<\/span>, iar acest acces ar trebui s\u0103 fie:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>limitat\n\u00een timp, utiliz\u00e2n<\/span>d controale\ntehnice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>jurnalizat\nelectronic pentru trasabilitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cembun\u0103t\u0103\u021birea securit\u0103\u021bii fizice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Zonele\ncritice ar trebui protejate cu m\u0103suri de control fizice, precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Camere\nde supraveghere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Agen\u021bi\nde securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>U\u0219i\n\u0219i por\u021bi \u00eencuiate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sisteme\nde alarm\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>m\u0103suri <\/span>de <\/span>control <\/span>ar <\/span>trebu<\/span>i <\/span>amplasate\n<\/span>strategic <\/span>pentru <\/span>monitoriza<\/span>rea <\/span>\u0219i <\/span>restric\u021bionarea\naccesului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protec\u021bia accesului la re\u021bea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Porturile <\/span>de <\/span>re\u021bea <\/span>interne\n<\/span>(de <\/span>exemplu, <\/span>Ethernet)\n<\/span>nu <\/span>ar <\/span>trebui <\/span>expuse <\/span>\u00een <\/span>zone <\/span>nesecurizate, precum s\u0103li de a\u0219teptare,\ncoridoare sau zone de recep\u021bie.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii specifice O<\/span>T<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>fizic <\/span>la <\/span>mediile <\/span>OT <\/span>(de <\/span>exemplu,\n<\/span>camere <\/span>de <\/span>control,\n<\/span>dulapuri, <\/span>dispozitive <\/span>de <\/span>teren) <\/span>ar trebui limitat doar la personalul\nautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>ar <\/span>trebui\n<\/span>jurnali<\/span>zat <\/span>\u0219i <\/span>monitorizat, <\/span>iar <\/span>atunci <\/span>c\u00e2nd <\/span>este <\/span>fezabil,\n<\/span>ar <\/span>trebui <\/span>utilizate bariere fizic<\/span>e.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Referin\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>instrumente <\/span>\u0219i <\/span>\u0219abloane <\/span>practice,\n<\/span>consulta\u021bi <\/span>Politica <\/span>de <\/span>acces <\/span>din <\/span>S<\/span>etul <\/span>de <\/span>instrumente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

CyFun\u00ae pe www<\/span>.cyfun.eu.<\/span><\/a><\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-06.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Controalele <\/span>accesului <\/span>fizic <\/span>trebuie\n<\/span>s\u0103 <\/span>includ\u0103 <\/span>proceduri\n<\/span>specifice <\/span>pentru <\/span>situa\u021bii\n<\/span>de <\/span>urgen\u021b\u0103, <\/span>asigur\u00e2nd protec\u021bia continu\u0103 a activelor critice\n\u0219i non<\/span>-critice \u00een timpul unor astfel\nde evenimente.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>controalele <\/span>accesului\n<\/span>fizic <\/span>r\u0103m\u00e2n <\/span>eficace\n<\/span>\u0219i <\/span>adaptabile \u00een <\/span>situa\u021bii\n<\/span>de <\/span>urgen\u021b\u0103. <\/span>Aceasta\n<\/span>include <\/span>men\u021binerea <\/span>securit\u0103\u021bii <\/span>activelor <\/span>critice <\/span>\u0219i <\/span>non<\/span>-critice,\n<\/span>permi\u021b\u00e2nd \u00een acela\u0219i timp accesul sigur, autorizat \u0219i trasabil pentru\nac\u021biuni d<\/span>e r\u0103spuns la urgen\u021be,\nrecuperare sau izolare <\/span>– <\/span>\u00een <\/span>special <\/span>\u00een <\/span>medii <\/span>\u00een <\/span>care <\/span>siguran\u021ba <\/span>fizic\u0103 <\/span>\u0219i <\/span>opera\u021bional\u0103 <\/span>sunt <\/span>str\u00e2ns <\/span>legate,\n<\/span>precum <\/span>sistemele OT \u0219i IoT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea unor s<\/span>cenarii\nde ur<\/span>gen\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile\nde ur<\/span>gen\u021b\u0103 ar trebui s\u0103 acopere o\nserie de evenimente, printre care:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Incidente <\/span>de <\/span>mediu <\/span>\u0219i <\/span>de <\/span>siguran\u021b\u0103\n<\/span>(de <\/span>exemplu, <\/span>incendii,\n<\/span>inunda\u021bii, <\/span>ur<\/span>gen\u021be <\/span>medicale,\nevacu\u0103ri).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Defec\u021biuni <\/span>ale <\/span>infrastructurii <\/span>(de <\/span>exemplu, <\/span>\u00eentreruperi <\/span>de <\/span>curent, <\/span>defec\u021biuni <\/span>ale <\/span>sistemului).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Incidente <\/span>de <\/span>securitate <\/span>(de <\/span>exemplu, <\/span>intruziun<\/span>i, <\/span>defec\u021biuni <\/span>ale <\/span>sistemului <\/span>de <\/span>control <\/span>al accesului).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Evenimente <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>(de <\/span>exemplu, <\/span>ransomware, <\/span>\u00eenc\u0103lc\u0103ri <\/span>ale <\/span>securit\u0103\u021bii datelor<\/span>, ame<\/span>nin\u021b\u0103ri din\ninterior).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea procedurilor <\/span>de acces \u00een caz de ur<\/span>gen\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul\nde ur<\/span>gen\u021b\u0103 ar trebui s\u0103 fie:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Jurnalizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>\u00cenregistrarea\na cine a accesat ce, c\u00e2nd \u0219i de ce.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Monitorizat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Utilizarea <\/span>sistemelor <\/span>de <\/span>supraveghere <\/span>sau <\/span>de <\/span>control\n<\/span>al <\/span>accesului <\/span>pentru <\/span>urm\u0103rirea\nactivit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Revizuit<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Efectuarea <\/span>revizuirilor <\/span>dup\u0103 <\/span>eveniment <\/span>pentru <\/span>verificarea <\/span>utili<\/span>z\u0103rii <\/span>corespunz\u0103toare <\/span>\u0219i detec\u021bia utiliz\u0103rii necorespunz\u0103toare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea preg\u0103tirii pentru situa\u021bii de ur<\/span>gen\u021b\u0103 cu controale fizice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>men\u021binute\n<\/span>liste <\/span>actualizate <\/span>cu <\/span>persoanele <\/span>fizice <\/span>care <\/span>sunt <\/span>au<\/span>torizate\n<\/span>cu <\/span>drepturi <\/span>de acces \u00een situa\u021bii de ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizate\n<\/span>documente <\/span>de <\/span>identitate <\/span>(de <\/span>exemplu, <\/span>cartele\n<\/span>de <\/span>acces) <\/span>\u0219i <\/span>ar <\/span>trebui <\/span>definite\nzone de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cerin\u021be\nde escort\u0103 ar trebui aplicate vi<\/span>zitatorilor\nsau personalului temporar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>implementate <\/span>bariere <\/span>fizice, <\/span>precu<\/span>m <\/span>garduri,\n<\/span>\u00eencuietori, <\/span>turniche\u021bi <\/span>\u0219i <\/span>puncte <\/span>de control cu personal.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>de <\/span>supraveghere <\/span>ar <\/span>trebui <\/span>utilizate <\/span>pentru <\/span>monitorizarea <\/span>punctelor <\/span>de <\/span>intrare <\/span>\u0219i ie\u0219ire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplica<\/span>rea de\nm\u0103suri de siguran\u021b\u0103 suplimentare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>luate <\/span>\u00een <\/span>considerare <\/span>sisteme <\/span>de <\/span>cartele\n<\/span>cu <\/span>niveluri <\/span>de <\/span>acces <\/span>diferen\u021biate <\/span>pentru <\/span>diverse zone.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>fizic <\/span>la <\/span>servere <\/span>\u0219i <\/span>componente <\/span>de <\/span>re\u021bea <\/span>ar <\/span>trebui <\/span>restric\u021bionat <\/span>numai <\/span>la <\/span>personalul autorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate acces\u0103rile\nla infrastructura critic\u0103 ar trebui jurnalizate \u0219i revizuite periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Men\u021binerea <\/span>\u0219i <\/span>revizuirea <\/span>– <\/span>\u00cenregistr\u0103rile <\/span>privind\n<\/span>accesul <\/span>vizitatorilor <\/span>ar <\/span>trebui <\/span>men\u021binute\n<\/span>\u0219i revizuite. Dac\u0103 este necesar<\/span>,\nar trebui luate m\u0103suri corective.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen  <\/span>mediile  <\/span>OT<\/span>,  <\/span>procedurile \n<\/span>de  <\/span>acces  <\/span>fizic \n<\/span>ar  <\/span>trebui  <\/span>adaptate \n<\/span>pentru <\/span>evitarea  <\/span>perturb\u0103rii siguran\u021bei <\/span>sau <\/span>a <\/span>continuit\u0103\u021bii <\/span>opera\u021bionale. <\/span>Accesul <\/span>de <\/span>ur<\/span>gen\u021b\u0103 <\/span>ar <\/span>trebui <\/span>proiectat <\/span>astfel <\/span>\u00eenc\u00e2t\ns\u0103 permit\u0103 at\u00e2t o reac\u021bie rapid\u0103, c\u00e2t \u0219i protec\u021bi<\/span>a activelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>aliniate <\/span>la <\/span>Ghidul <\/span>tehnic\n<\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de <\/span>c\u0103tre\nENISA, <\/span>care <\/span>subliniaz\u0103 <\/span>importan\u021ba <\/span>controalelor <\/span>de <\/span>acces <\/span>fizic <\/span>\u0219i <\/span>logic <\/span>\u00een <\/span>men\u021binerea <\/span>rez<\/span>ilien\u021bei \u00een\nsitua\u021bii de ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-06.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Zonele <\/span>critice <\/span>trebuie <\/span>s\u0103 <\/span>dispun\u0103 <\/span>de <\/span>controale <\/span>fizi<\/span>ce <\/span>suplimentare <\/span>ale <\/span>accesului, <\/span>pe <\/span>l\u00e2ng\u0103 <\/span>cele <\/span>aplicate\nincintelor.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>riscul\n<\/span>accesului <\/span>fizic <\/span>neautorizat <\/span>\u00een <\/span>zonele <\/span>esen\u021biale <\/span>pentru continuitatea opera\u021bional\u0103, integritatea datelor \u0219i\nsiguran\u021ba personalului \u0219i a echipamentelor, prin aplicarea unor m\u0103suri de acces\nmai stricte dec\u00e2t cele utilizate \u00een zonele ge<\/span>nerale\nale incintelor.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate <\/span>\u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Zonele critice ar trebui identificate \u00een timpul\nclasific\u0103rii activelor<\/span>. <\/span>Acestea includ, de obicei:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Medii\nde produc\u021bie \u0219i OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>S\u0103li\nde servere \u0219i centre de date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Birourile\nfin<\/span>anciare \u0219i de <\/span>resurse umane.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>S\u0103li\nde control.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Loca\u021bii\n\u00een ca<\/span>re sunt stocate informa\u021bii\nsensibile sa<\/span>u clasificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ar trebui luate \u00een considerare urm\u0103toarele controale\nfizice \u00eembun\u0103t\u0103<\/span>\u021bite ale accesului:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Autentificarea\ncu doi factori (de exemplu, cartel\u0103 + date biometrice).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Supravegherea <\/span>continu\u0103\n<\/span>(de <\/span>exemplu, <\/span>re\u021bea <\/span>video <\/span>cu <\/span>circuit <\/span>\u00eenchis\n<\/span>– <\/span>CCTV<\/span>, <\/span>senzori <\/span>d<\/span>e\nmi\u0219care).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnalizarea\naccesului cu revizuire pe<\/span>riodic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Personal\nde securitate la fa\u021b<\/span>a locului sau de\npatrulare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sisteme\nde alarm\u0103 cu alerte \u00een timp real.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Proceduri\nde gestionare a vizitatorilor:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Aprobare prealabil\u0103 \u0219i \u00eenso\u021bire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Acces\nlimitat \u00een timp.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Jurnale\nde vizitatori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea coeren\u021bei cu politicile mai ample privind\naccesul fizic, inclusiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>PR.AA-06.1\n– Controlul accesului bazat pe risc.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>PR.AA-06.2\n– Proceduri <\/span>de acces \u00een caz de ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>PR.AA-06.4\n– Protec\u021bia fizic\u0103 a activelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Adaptarea <\/span>controalelor <\/span>la <\/span>criticitatea <\/span>fiec\u0103rei\n<\/span>zone <\/span>\u0219i <\/span>integrarea <\/span>acesto<\/span>ra <\/span>\u00een <\/span>strategia\n<\/span>general\u0103 <\/span>de securitate fizic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AA-06.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activele <\/span>situate <\/span>\u00een <\/span>zone <\/span>critice <\/span>trebuie\n<\/span>protejate <\/span>fizic <\/span>\u00eempotriva <\/span>accesului <\/span>neau<\/span>torizat,\n<\/span>deterior\u0103rii <\/span>sau\ninterferen\u021belor.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>proteja <\/span>activele <\/span>esen\u021biale <\/span>situate \u00een\n<\/span>zone <\/span>critice <\/span>\u00eempotriva accesului <\/span>neautorizat, <\/span>deterior\u0103rii <\/span>sau <\/span>interferen\u021belor, <\/span>inten\u021bionate <\/span>sau <\/span>accidentale, <\/span>prin <\/span>ap<\/span>licarea\n<\/span>unor m\u0103suri de protec\u021bie fizic\u0103 adaptate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Activele <\/span>din <\/span>zonele <\/span>criti<\/span>ce <\/span>ar <\/span>trebui <\/span>protejate <\/span>fizic <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>criticitatea <\/span>\u0219i <\/span>profilul <\/span>lor <\/span>de <\/span>risc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceste\nactive ar <\/span>putea include:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Servere\n\u0219i sisteme de control.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Infrastructura\nelectric\u0103 \u0219i cablarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Depozite\nde date sensibil<\/span>e.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Componente\nOT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>M\u0103surile de protec\u021bie ar trebui s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Bariere\nfizice \u0219i izolare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Carcase\n\u00eencuiate, dulapuri securizate sau cu\u0219ti <\/span>pentru\nechipamente sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sigilii\ninviolabile pentru detec\u021bia accesului neautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>M\u0103suri <\/span>de <\/span>protec\u021bie <\/span>a <\/span>mediului <\/span>(de <\/span>exemplu, <\/span>stingerea\n<\/span>incendiilor<\/span>, <\/span>controlul\n<\/span>temperaturii)<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Protec\u021bia <\/span>infrastructurii:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Securizarea <\/span>cablurilor <\/span>de <\/span>alimentare <\/span>\u0219i <\/span>de <\/span>re\u021bea<\/span>, <\/span>a <\/span>interfe\u021belor <\/span>de <\/span>acces <\/span>\u0219i <\/span>a <\/span>echipamentelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sisteme\nde alimentare redundante \u0219i separate fizic pentru opera\u021biuni critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Controlul\naccesului \u0219i supravegherea:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>\u00censo\u021birea\nvizitatorilor<\/span>, v\u00e2nz\u0103torilor \u0219i\np\u0103r\u021bilor ter\u021be \u00een orice moment.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Men\u021binerea\n\u0219i revizu<\/span>irea periodic\u0103 a jurnalelor\nde acces.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controalele ar trebui s\u0103 fie aliniate cu cerin\u021bele\naferente, inclusiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>PR.AA-06.1\n– Controlul accesului bazat pe risc.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>PR.AA-06.2\n– Proceduri <\/span>de acces \u00een caz de ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>PR.AA-06.3\n– Controale de acces \u00eembun\u0103t\u0103\u021bite pentru zonele critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Protec\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>proactiv\u0103, <\/span>ini\u021biat\u0103\n<\/span>\u00een <\/span>timpul <\/span>clasific\u0103rii <\/span>activelor <\/span>\u0219i <\/span>proiect\u0103rii <\/span>incintelor \u0219i integrat\u0103 \u00een strategia <\/span>mai ampl\u0103 de securitate fizic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[PR.AT]\nCON\u0218TIENTIZARE \u0218I INSTRUI<\/span>RE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Personalul organiza\u021biei\nbeneficiaz\u0103 de con\u0219tientizare \u0219i instruire \u00een domeniul securit\u0103\u021bii cibernetice,\nastfel \u00eenc\u00e2t s\u0103 \u00ee\u0219i poat\u0103 \u00eendeplini sarcinile lega<\/span>te d<\/span>e securitatea\ncibernetic\u0103.<\/span><\/p>\n\n

PR.AT-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Personalul <\/span>beneficiaz\u0103 <\/span>de <\/span>activit\u0103\u021bi <\/span>de <\/span>con\u0219tientizare <\/span>\u0219i <\/span>instruire, <\/span>astfel\n<\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>de\u021bin\u0103 cuno<\/span>\u0219tin\u021bele \u0219i abilit\u0103\u021bile necesare pentru \u00eend<\/span>eplinirea sarcinilor generale, \u021bin\u00e2nd\ncont de riscurile de securitate cibernetic\u0103.<\/span><\/p>\n\n

PR.AT-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>stabileasc\u0103 <\/span>\u0219i <\/span>s\u0103 <\/span>men\u021bin\u0103\n<\/span>un <\/span>program <\/span>de <\/span>con\u0219tientizare <\/span>\u0219i <\/span>instruire <\/span>\u00een <\/span>domeniul\nsecurit\u0103\u021bii cibernetice pentru a se asigura c\u0103 tot personalul \u00een\u021belege cum s\u0103\n\u00ee\u0219i \u00eendeplineasc\u0103 sarcinile \u00een mod securizat \u0219i responsabil.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul Controlului PR.AT-01.1\neste de a asigura c\u0103 to\u021bi membrii organiza\u021biei \u00een\u021beleg cum s\u0103 lucreze <\/span>\u00een <\/span>mod <\/span>securizat, <\/span>prin <\/span>furnizarea <\/span>de <\/span>instruire <\/span>periodic\u0103, <\/span>clar\u0103 <\/span>\u0219i <\/span>prac<\/span>tic\u0103 <\/span>\u00een <\/span>domeniul <\/span>securit\u0103\u021bii cibernetice, <\/span>care <\/span>reduce <\/span>riscul\n<\/span>uman <\/span>\u0219i <\/span>sus\u021bine\n<\/span>un <\/span>comportament <\/span>sigur\n<\/span>at\u00e2t <\/span>\u00een <\/span>mediile\n<\/span>IT, <\/span>c\u00e2t <\/span>\u0219i <\/span>\u00een <\/span>cele OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui <\/span>luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea de baz\u0103 ar trebui furnizat\u0103 tuturor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instruirea <\/span>pentru <\/span>con\u0219tientizarea <\/span>\u00een <\/span>domeniul <\/span>securit\u0103\u021bii <\/span>cibernetice <\/span>ar <\/span>trebui\n<\/span>asigurat\u0103 <\/span>tuturor angaja\u021bilor<\/span>, contractorilor<\/span>, partenerilor <\/span>\u0219i\nfurnizorilor<\/span>, inclusiv <\/span>celor din\n<\/span>mediile OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea ar trebui s\u0103 <\/span>acopere amenin\u021b\u0103rile comune<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ematici <\/span>pre<\/span>cum <\/span>phishing-ul, <\/span>parolele\n<\/span>slabe, <\/span>ingineria <\/span>social\u0103\n<\/span>\u0219i <\/span>riscurile <\/span>specifice <\/span>OT <\/span>(de exemplu, <\/span>utilizarea <\/span>necorespunz\u0103<\/span>toare <\/span>a <\/span>USB-urilor<\/span>, <\/span>amenin\u021b\u0103<\/span>ri <\/span>legate <\/span>de <\/span>accesul <\/span>la <\/span>dista<\/span>n\u021b\u0103) ar trebui incluse.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea ar trebui s\u0103 \u00eenceap\u0103 devreme \u0219i s\u0103 fie\nrepetat\u0103 periodic<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instruirea <\/span>ar <\/span>trebui <\/span>furnizat\u0103 <\/span>\u00een <\/span>timpul <\/span>procesului <\/span>de <\/span>integrare <\/span>or<\/span>ganiza\u021bional\u0103 <\/span>\u0219i <\/span>re\u00eennoit\u0103 <\/span>cel pu\u021bin anual. <\/span>Actualiz\u0103rile \u0219i memento-urile continue ar trebui s\u0103 consolideze\nmesajele cheie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ar trebui utilizate canale multiple<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Con\u0219tientizarea <\/span>ar <\/span>trebui\n<\/span>sporit\u0103 <\/span>prin <\/span>sesiuni\n<\/span>structurate, <\/span>campanii, <\/span>afi\u0219e,\n<\/span>buletine <\/span>informative \u0219i\ninstrumente interactive.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Consecin\u021bele neconformit\u0103\u021bii ar trebui explicate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Impactul <\/span>\u00eenc\u0103lc\u0103r<\/span>ii <\/span>politi<\/span>cilor <\/span>de <\/span>securitate\n<\/span>cibernetic\u0103 <\/span>ar <\/span>trebui <\/span>comunicat <\/span>\u00een <\/span>mod <\/span>clar<\/span>, <\/span>at\u00e2t persoanelor fizice, c\u00e2t \u0219i or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea ar trebui\n<\/span>s\u0103 fie aliniat\u0103 cu politicile \u0219i bunele practici<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Con\u021binutul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>reflecte <\/span>politi<\/span>cile <\/span>interne <\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>comportamentele a\u0219teptate <\/span>\u0219i <\/span>m\u0103surile\n<\/span>de <\/span>protec\u021bie. <\/span>Ca<\/span>drele <\/span>recunoscute, <\/span>precu<\/span>m <\/span>AR<\/span>-in-a-Box <\/span>elaborat\n<\/span>de <\/span>c\u0103tre ENISA, ar trebui s\u0103 ghid<\/span>eze proiecta<\/span>rea programului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Riscurile specifice OT <\/span>ar trebui abordate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instruirea <\/span>ar <\/span>trebui\n<\/span>adaptat\u0103 <\/span>pentru <\/span>a include <\/span>responsabilit\u0103\u021bile <\/span>\u0219i <\/span>riscurile <\/span>specifice <\/span>cu <\/span>care <\/span>se\nconfrunt\u0103 personalul care lucreaz\u0103 cu ICS \u0219i alte active OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Con\u021binutul ar trebui actualizat \u00een permanen\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Materialele <\/span>de <\/span>instruire\n<\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>\u0219i <\/span>actualizate <\/span>periodic\n<\/span>pentru <\/span>a <\/span>reflecta\n<\/span>noile amenin\u021b\u0103ri \u0219i lec\u021biile \u00eenv\u0103\u021bate din inc<\/span>idente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AT-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 includ\u0103\n\u00een instruirea sa pentru securitatea cibernetic\u0103, con\u0219tientizarea \u0219i raportarea\namenin\u021b\u0103rilor din interior, pentru a ajuta personalul s\u0103 recu<\/span>noasc\u0103 \u0219i s\u0103 r\u0103spun<\/span>d\u0103 la poten\u021bialele <\/span>riscuri <\/span>interne.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>tot <\/span>personalul <\/span>este <\/span>instruit\n<\/span>s\u0103 <\/span>recunoasc\u0103 <\/span>\u0219i <\/span>s\u0103 <\/span>raporteze poten\u021bialele amenin\u021b\u0103ri\ninterne, reduc\u00e2nd astfel riscul incidentelor interne de securitate c<\/span>ibernetic\u0103. Acest <\/span>Control <\/span>se <\/span>bazeaz\u0103\n<\/span>pe <\/span>con\u0219tientizarea <\/span>general\u0103\n<\/span>din <\/span>PR.AT-01.1, <\/span>introduc\u00e2nd <\/span>scenarii <\/span>specifice de\namenin\u021bare \u0219i ac\u021biuni de r\u0103spuns.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instruirea  <\/span>ar \n<\/span>trebui  <\/span>s\u0103  <\/span><\/span>includ\u0103  <\/span>modul \n<\/span>de  <\/span>recunoa\u0219tere  <\/span>a \n<\/span>semnelor  <\/span>comportamentale  <\/span>ale amenin\u021b\u0103rilor din interior<\/span>, precum tiparele de acces neobi\u0219nuite,\nacumularea de date sau modific\u0103ri bru\u0219te de comportament.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>defineasc\u0103 <\/span>\u00een <\/span>mod <\/span>clar <\/span>amenin\u021b\u0103rile <\/span>din <\/span>inter<\/span>ior <\/span>(de <\/span>exemplu, <\/span>persoane\ndin interior r\u0103u inten\u021bionate, neglijen<\/span>te\nsau compromise, inclusiv angaja\u021bi \u0219i contractori).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Personalul <\/span>ar <\/span>trebui <\/span>instruit\n<\/span>cu <\/span>privire <\/span>la <\/span>modul <\/span>\u0219i <\/span>locul <\/span>\u00een <\/span>care <\/span>trebuie\n<\/span>raportate <\/span>activit\u0103\u021bile\nsuspecte \u0219i referitor la importan\u021ba raport\u0103rii \u00een timp util.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar <\/span>trebui <\/span>utilizate\n<\/span>studii <\/span>de <\/span>caz <\/span>reale <\/span>sau <\/span>simul\u0103ri <\/span>pentru <\/span>demonstrarea <\/span>impactului\n<\/span>amenin\u021b\u0103rilor din interior \u0219i pentru consolidarea procesului de\n\u00eenv\u0103\u021bare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Con\u0219tientizarea <\/span>amenin\u021b\u0103rilor <\/span>din <\/span>interior <\/span>ar <\/span>tr<\/span>ebui <\/span>s\u0103 <\/span>fac\u0103 <\/span>p<\/span>arte <\/span>din <\/span>instruirea <\/span>periodic\u0103 <\/span>de\nsecuritate \u0219i din procesul de integrare or<\/span>ganiza\u021bional\u0103\na \u00eentreg<\/span>ului personal.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Personalul care are acces la date sau\nsisteme sensibile ar trebui s\u0103 beneficieze de instruire specializat\u0103, axat\u0103 pe\nresponsabilit\u0103\u021bile specific<\/span>e ale\nacestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ar <\/span>trebui <\/span>dezvoltate\n<\/span>echipe <\/span>de <\/span>instruire\n<\/span>interfunc\u021bionale, <\/span>cu <\/span>expertiz\u0103\n<\/span>at\u00e2t <\/span>\u00een <\/span>domeniul <\/span>securit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

IT<\/span>, c\u00e2t \u0219i \u00een domeniul opera\u021bional OT <\/span>(instruire \u00eencruci\u0219at\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instruirea <\/span>anual\u0103 <\/span>de <\/span>perfec\u021bionare <\/span>ar <\/span>trebui <\/span>utilizat\u0103 <\/span>pentru <\/span>a <\/span>consolida <\/span>me<\/span>sajele <\/span>cheie\n<\/span>\u0219i <\/span>a introduce actualiz\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>promoveze <\/span>o <\/span>cultur\u0103 <\/span>a <\/span>securit\u0103\u021bii\n\u00een <\/span>care <\/span>angaja\u021bii <\/span>se <\/span>simt <\/span>\u00een <\/span>siguran\u021b\u0103\n<\/span>s\u0103 raporteze problemele f\u0103r\u0103 teama de represalii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AT-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Personalul trebuie s\u0103\nprimeasc\u0103 instruire pentru <\/span>a–<\/span>\u0219i \u00een\u021belege rolurile, resp<\/span>onsabilit\u0103\u021bile \u0219i priorit\u0103\u021bile specifice\n\u00een timpul unui incident de securitate cibernetic\u0103 sau a informa\u021biei, inclusiv\npa\u0219ii pe care trebuie s\u0103 \u00eei urmeze pentru <\/span>a\nr\u0103spunde \u00een mod eficace.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>\u00eentreg <\/span>personalul <\/span>\u00ee\u0219i <\/span>\u00een\u021belege <\/span>rolurile, <\/span>responsabilit\u0103\u021bile \u0219i <\/span>priorit\u0103\u021bile <\/span>specifice <\/span>pe <\/span>care <\/span>le <\/span>are <\/span>\u00een <\/span>timpul <\/span>unui <\/span>incident <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei, permi\u021b\u00e2ndu-le s\u0103 r\u0103spun<\/span>d\u0103 \u00een mod eficace \u0219i \u00een coordonare <\/span>cu planurile de r\u0103spuns la incidente \u0219i de\nurgen\u021b\u0103 ale organiza\u021biei. Acest Control se bazea<\/span>z\u0103 pe con\u0219tientizarea specific\u0103 a amenin\u021b\u0103rilor din PR.AT-01.2,\nintroduc\u00e2n<\/span>d instruirea bazat\u0103 pe\nroluri \u0219i preg\u0103tirea pentru r\u0103<\/span>spunsul\nla incidente.<\/span><\/p>\n\n

\u00cen vederea real<\/span>iz\u0103rii\nacestui obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instruirea <\/span>ar <\/span>trebui <\/span>adaptat\u0103\n<\/span>diferitelor <\/span>roluri <\/span>(de <\/span>exemplu, <\/span>IT<\/span>, <\/span>resurse\n<\/span>umane, <\/span>cadre <\/span>de <\/span>conducere),\nastfel \u00eenc\u00e2t fiecare grup s\u0103 \u00ee\u0219i <\/span>\u00een\u021beleag\u0103\nresponsabilit\u0103\u021bile <\/span>sale specifice \u00een\ncazul <\/span>unui incident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Personalul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>familiarizat <\/span>cu <\/span>obiectivele <\/span>sale,\n<\/span>priorit\u0103\u021bile <\/span>de <\/span>recuperare <\/span>\u0219i <\/span>ordinea corect\u0103 a\nac\u021biunilor care ar trebui <\/span>\u00eentreprinse\n\u00een timpul unui incident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Exerci\u021biile <\/span>teoretice <\/span>sau <\/span>simul\u0103rile\n<\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>pentru <\/span>a <\/span>e<\/span>xersa <\/span>r\u0103spu<\/span>nsul <\/span>la <\/span>incidente <\/span>\u00eentr<\/span>–\nun mediu realist, dar controlat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>furnizat\u0103 <\/span>o <\/span>documenta\u021bie <\/span>clar\u0103 <\/span>care <\/span>s\u0103 <\/span>prezinte <\/span>sarcinile\n<\/span>\u0219i <\/span>respo<\/span>nsabilit\u0103\u021bile <\/span>fiec\u0103rui <\/span>rol \u00een timpul unui incident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instruirea ar trebui s\u0103 explice modul\n\u00een care r\u0103s<\/span>punsul la in<\/span>cidente se leag\u0103 de planificarea de ur<\/span>gen\u021b\u0103, <\/span>asigur\u00e2nd <\/span>c\u0103 <\/span>personalul <\/span>\u00een\u021belege\n<\/span>c\u00e2nd <\/span>\u0219i <\/span>cum <\/span>s\u0103 <\/span>activeze\n<\/span>m\u0103surile <\/span>de <\/span>ur<\/span>gen\u021b\u0103 <\/span>(a <\/span>se <\/span>vedea \u0219i ID.IM-04.1).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>or<\/span>ganizate\n<\/span>sesiuni <\/span>periodice <\/span>de <\/span>perfec\u021bionare <\/span>pentru <\/span>men\u021binerea <\/span>cuno\u0219tin\u021belor <\/span>actualizate \u0219i consolidarea preg\u0103tirii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AT-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nevalueze dac\u0103 instruirea sa pentr<\/span>u\ncon\u0219tientizare \u00een domeniul securit\u0103\u021bii cibernetice este eficace \u00een \u00eembun\u0103t\u0103\u021birea\ncuno\u0219tin\u021belor, comportamentului \u0219i preg\u0103tirii \u00een cadrul organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>instruirea <\/span>pentru\n<\/span>con\u0219tientizare <\/span>\u00een <\/span>domeniul\n<\/span>securit\u0103\u021bii cibernetice conduce la \u00eembun\u0103t\u0103\u021biri m\u0103surabile \u00een ceea ce\nprive\u0219te cuno\u0219tin\u021bele personalului, comportamentul securizat \u0219i preg\u0103tirea\npentru a <\/span>r\u0103s<\/span>punde la amenin\u021b\u0103rile cibernetice la toate nivelurile <\/span>organiza\u021biei. <\/span>Acest <\/span>Control <\/span>se <\/span>bazeaz\u0103 <\/span>pe <\/span>con\u0219tientizarea <\/span>specific\u0103\n<\/span>amenin\u021b\u0103rilor din PR.AT-01.2 <\/span>\u0219i <\/span>pe <\/span>instruirea <\/span>bazat\u0103 <\/span>pe <\/span>roluri din <\/span>PR.AT<\/span>–<\/span>01.3, <\/span>prin <\/span>introducerea <\/span>unei <\/span>abord\u0103ri\nstructurate pentru m<\/span>\u0103surarea\nimpactului eforturilor de con\u0219tientizare.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021bia\nar trebui s\u0103 evalueze dac\u0103 instruirea pentru con\u0219tientizare este accesibil\u0103\n\u00eentregului personal relevant <\/span>\u0219i <\/span>d<\/span>a<\/span>c\u0103 <\/span>influen\u021beaz\u0103 <\/span>\u00een <\/span>mod <\/span>efi<\/span>cace <\/span>comportamentul, <\/span>con\u0219tien<\/span>tizarea <\/span>\u0219i atitudinile acestuia \u00een mate<\/span>rie de securitate cibernetic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dac\u0103\n<\/span>or<\/span>ganiza\u021bia <\/span>nu <\/span>are <\/span>experien\u021b\u0103\n<\/span>\u00een <\/span>evaluare, <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare <\/span>utilizarea\n<\/span>cadrelor sau <\/span>instrumentelor <\/span>evaluate\n<\/span>exi<\/span>stente, <\/span>precum\n<\/span>AR-in-a-Box <\/span>elaborat <\/span>de <\/span>c\u0103tre <\/span>ENISA, <\/span>care <\/span>include \u00eendrum\u0103ri privind stabilirea obiectivelor<\/span>, selectarea KPI<\/span>-urilor \u0219i m\u0103surarea impactului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cen\n<\/span>cazul <\/span>elabor\u0103rii <\/span>unei <\/span>metode <\/span>de <\/span>evaluare <\/span>la <\/span>nivel <\/span>intern,\n<\/span>or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>analizeze <\/span>bunele practici \u0219i abord\u0103rile baz<\/span>ate pe dovezi pentru evaluarea\nprogramelor de con\u0219tientizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Metodele de evaluare ar trebui s\u0103 includ\u0103 o combina\u021bie\nde:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evalu\u0103ri\nsau teste \u00eenainte \u0219i dup\u0103 instruire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>este simula<\/span>te de phishing sau inginerie social\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sondaje  <\/span> <\/span><\/span>pentru \n<\/span> <\/span><\/span>m\u0103surarea  <\/span> <\/span><\/span>modific\u0103rilor  <\/span> <\/span><\/span>\u00een \n<\/span> <\/span><\/span>materie \n<\/span> <\/span><\/span>de \n<\/span> <\/span><\/span>con\u0219tientizare,  <\/span> <\/span><\/span>\u00eencredere  <\/span> <\/span><\/span>\u0219i comportament.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Observa\u021bii\nde la participan\u021bi \u0219i instructori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021bia\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>docume<\/span>nteze  <\/span><\/span>lec\u021biile  <\/span><\/span>\u00eenv\u0103\u021bate  <\/span>\u0219i  <\/span><\/span>s\u0103  <\/span><\/span>utilizeze  <\/span><\/span>rezultatele  <\/span><\/span>pentru\n\u00eembun\u0103t\u0103\u021birea eforturilor vii<\/span>toare de instruire.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AT-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Persoanele <\/span>fizice <\/span>care <\/span>ocup\u0103 <\/span>func\u021bii <\/span>specializate <\/span>beneficiaz\u0103 <\/span>de <\/span>con\u0219tientizare <\/span>\u0219i <\/span>instruire, <\/span>astfel <\/span>\u00eenc\u00e2t\ns\u0103 <\/span>de\u021bin\u0103 <\/span>cuno\u0219tin\u021bele <\/span>\u0219i <\/span>competen\u021bele <\/span>necesare <\/span>pentru <\/span>\u00eendeplinirea <\/span>sarcinilor <\/span>relevante, <\/span>\u021bin\u00e2nd <\/span>seam<\/span>a de ris<\/span>curile\nde securitate cibernetic\u0103.<\/span><\/p>\n\n

PR.AT-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Membrii organelor de\nconducere trebuie s\u0103 poat\u0103 demonstra c\u0103 au urmat cursuri de instruire care le<\/span>– au permis s\u0103 dob\u00e2ndeasc\u0103 cuno\u0219tin\u021be\nsolide \u00een domeniul <\/span>securit\u0103\u021bii\ncibernetice sau a informa\u021biei, precum \u0219i al managemen<\/span>tului riscului, astfel \u00eenc\u00e2t s\u0103 poat\u0103 evalua riscurile de\nsecuritatea cibernetic\u0103 sau a informa\u021biei \u0219i consecin\u021bele acestora \u0219i s\u0103\npropun\u0103 m\u0103surile necesare de atenuare a riscurilor, \u021bin\u00e2nd seama de rolurile,\nresponsabilit\u0103\u021bile \u0219i atribu\u021biile lor <\/span>de\nautoritate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 membrii organelor de conducere sunt preg\u0103ti\u021bi s\u0103\nia decizii informate cu privire la riscurile de securitate cibernetic\u0103 \u0219i\nstrategiile de atenuare a acestora<\/span>,\ndezvolt\u00e2nd <\/span>o  <\/span>\u00een\u021belegere \n<\/span>fundamental\u0103  <\/span>a  <\/span>securit\u0103\u021bii \n<\/span>informa\u021biei,  <\/span>a  <\/span>ame<\/span>nin\u021b<\/span>\u0103rilor \n<\/span>cibernetice  <\/span>\u0219i  <\/span>a principiilor de management al riscului\nrelevante pentru rolurile lor de conducere.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instr<\/span>uirea <\/span>profesional\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>furnizeze <\/span>conducerii <\/span>capacitatea <\/span>de <\/span>a <\/span>evalua <\/span>riscurile\n<\/span>de securitate cibernetic\u0103, de a \u00een\u021belege impactul poten\u021bial al acestora\n\u0219i de a propune m\u0103suri de atenuare adecvate, \u00een concordan\u021b\u0103 cu responsabilit\u0103\u021bile\n\u0219i autoritatea <\/span>lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Con\u021binutul <\/span>instruirii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conceptele\nde baz\u0103 ale securit\u0103\u021bii cibernetice sau a informa\u021biei;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea,\nevaluarea \u0219i atenuarea riscurilor;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Luarea\ndeciziilor strategice \u00een contextul amenin\u021b\u0103rilor cibernetice;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Recunoa\u0219terea\npoten\u021bialelor lacune de securitate \u0219i a responsabilit\u0103\u021bilor de guvernan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instruirea <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>adaptat\u0103\n<\/span>rol<\/span>urilor <\/span>de <\/span>conducere, <\/span>utiliz\u00e2nd <\/span>recomand\u0103rile <\/span>ENISA <\/span>privind profilurile <\/span>de <\/span>rol, inclusiv <\/span>titlurile, <\/span>misiunile, <\/span>sarcinile, <\/span>abilit\u0103\u021bile <\/span>\u0219i <\/span>com<\/span>peten\u021bele\n<\/span>(a <\/span>se <\/span>vedea profilurile de rol prev\u0103zute \u00een ECSF).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar trebui luate \u00een considerare\nsesiuni anuale de perfec\u021bionare pentru consolidarea practicilor existente \u0219i\nintroducerea noilor evolu\u021bii \u00een domeniul securit\u0103\u021bii cibernetice \u0219i al\nmanagementului riscului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AT-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Persoanelor <\/span>fizice <\/span>care <\/span>ocup\u0103 <\/span>func\u021bii\nspecializate trebuie <\/span>s\u0103 <\/span>le fie <\/span>furnizate <\/span>con\u0219tientiza<\/span>re <\/span>\u0219i <\/span>instruire \u00eenainte <\/span>de <\/span>acordarea <\/span>privilegiilor, <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 de\u021bin\u0103\n<\/span>cuno\u0219tin\u021bele <\/span>\u0219i <\/span>competen\u021bele <\/span>necesare <\/span>pentru\n\u00eendeplinirea sarcinilor relevante, \u021bin\u00e2nd seama de riscurile de securitate\ncibernetic\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>persoanele <\/span>fizice <\/span>care <\/span>ocup\u0103 <\/span>func\u021bii\nspecializate beneficiaz\u0103 de con\u0219tientizare \u0219i instruire \u00een domeniul <\/span>securit\u0103\u021bii cibernetice \u00eenainte de a primi\nacces privilegiat, <\/span>permi\u021b\u00e2ndu-le <\/span>s\u0103 <\/span>\u00ee\u0219i <\/span>\u00eendeplineasc\u0103 <\/span>sarcinile cu <\/span>o <\/span>bun\u0103 <\/span>\u00een\u021belegere <\/span>a <\/span>riscurilor <\/span>de <\/span>securit<\/span>ate cibernetic\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Rolurile <\/span>specializate <\/span>din <\/span>cadrul <\/span>or<\/span>ganiza\u021biei <\/span>care necesit\u0103 <\/span>instruire <\/span>suplimentar\u0103 <\/span>\u00een <\/span>domeniul\nsecurit\u0103\u021bii cibernetice (de exemplu, personalul fizic \u0219i de securitate\ncibernetic\u0103, personalul financiar<\/span>, <\/span>persoanele <\/span>cu <\/span>func\u021bii <\/span>de <\/span>conducere <\/span>\u0219i <\/span>orice <\/span>persoan\u0103\n<\/span>care <\/span>are <\/span>acces\n<\/span>la <\/span>date <\/span>critice\n<\/span>pentru activitate) ar trebui identificate \u00een mod oficial.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>o\u021bi\n<\/span>cei <\/span>care <\/span>ocup\u0103 <\/span>func\u021bii <\/span>specializate, <\/span>inclusiv <\/span>contractorii, <\/span>partenerii, <\/span>fur<\/span>nizorii <\/span>\u0219i <\/span>alte <\/span>p\u0103r\u021bi <\/span>ter\u021be,\nar <\/span>trebui <\/span>s\u0103 <\/span>beneficieze <\/span>de <\/span>con\u0219tientizare <\/span>\u0219i <\/span>instruire <\/span>\u00een <\/span>materie <\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>\u00een <\/span>func\u021bie de rolul pe\ncare \u00eel ocup\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>s\u0103 <\/span>se <\/span>asigure <\/span>c\u0103 <\/span>instruirea <\/span>este <\/span>furnizat\u0103 <\/span>\u00eenainte\n<\/span>de <\/span>acordarea <\/span>accesului\n<\/span>\u0219i <\/span>c\u0103 <\/span>este <\/span>adaptat\u0103\nriscurilor \u0219i responsabilit\u0103\u021bilor specifice fiec\u0103rui rol.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Persoanele <\/span>fizice <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>evaluate <\/span>periodic\n<\/span>\u0219i <\/span>testate <\/span>cu <\/span>privire <\/span>la <\/span>\u00een\u021belegerea <\/span>practicilor <\/span>de securitate cibernetic\u0103 prin teste, simul\u0103ri sau evalu\u0103ri\npractice relevante pentru rolul lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea  <\/span><\/span>\u00een  <\/span><\/span>considerare  <\/span><\/span>a  <\/span><\/span>or<\/span>ganiz\u0103rii  <\/span><\/span>de  <\/span><\/span>cursuri  <\/span>anuale  <\/span><\/span>de  <\/span><\/span>perfec\u021bionare  <\/span><\/span>pentru  <\/span><\/span>conso<\/span>lidarea practicilor existente \u0219i\nintroducerea unor noi practici.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>incluse <\/span>at\u00e2t <\/span>contextul <\/span>IT<\/span>, <\/span>c\u00e2t <\/span>\u0219i <\/span>cel <\/span>OT<\/span>, <\/span>\u00een <\/span>special\n<\/span>pentru <\/span>rolurile <\/span>care interac\u021bioneaz\u0103 <\/span>cu sistemele industriale sau\ninfrastructura critic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.AT-02.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Utilizatorii <\/span>privilegia\u021bi <\/span>trebuie <\/span>califica\u021bi <\/span>\u00eenainte\n<\/span>de <\/span>acordarea <\/span>privilegiilor, <\/span>iar <\/span>ace\u0219ti <\/span>utilizatori <\/span>trebuie s\u0103 poat\u0103 de<\/span>monstra\n\u00een\u021belegerea rolurilor, responsabilit\u0103\u021bilor \u0219i a atribu\u021biilor lor de autoritate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>p<\/span>e<\/span>rsoanele <\/span>fizice <\/span>c\u0103rora <\/span>li <\/span>s-a <\/span>acordat\n<\/span>acces <\/span>privilegiat, fie \u00een\nmedii IT, fie \u00een medii OT, sunt \u00een mod demonstrabil competente \u0219i pe deplin\ncon\u0219tiente de responsabilit\u0103\u021bile, <\/span>riscuril<\/span>e <\/span>\u0219i <\/span>limitele\n<\/span>autorit\u0103\u021bii <\/span>le<\/span>gate <\/span>de <\/span>rolul <\/span>lor <\/span>\u00een <\/span>domeniul <\/span>securit\u0103\u021bii <\/span>cib<\/span>ernetice. Aceasta <\/span>reduce <\/span>probabilitatea <\/span>utiliz\u0103<\/span>rii <\/span>accidentale <\/span>sau <\/span>a <\/span>exploat\u0103rii <\/span>abuzive <\/span>a <\/span>privilegiilor <\/span>ridicate, \u00een special \u00een sistemele cri<\/span>tice \u00een care <\/span>continuitatea\nopera\u021bional\u0103 <\/span>\u0219i siguran\u021ba sunt \u00een\njoc.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebu<\/span>i luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizatorii <\/span>cu <\/span>drepturi <\/span>privilegiate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>instrui\u021bi\n<\/span>\u00een <\/span>diverse <\/span>aspecte <\/span>pentru <\/span>a <\/span>asigura <\/span>c\u0103 \u00ee\u0219i <\/span>utilizeaz\u0103 <\/span>drepturile\n<\/span>de <\/span>acces <\/span>ridicate <\/span>\u00eentr-un <\/span>mod <\/span>sigur <\/span>\u0219i <\/span>responsabil. <\/span>Ar <\/span>putea <\/span>fi <\/span>considerate\nurm\u0103toarele subiecte de instruire:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Con\u0219tientizarea\nsecurit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Este  <\/span>esen\u021bial \n<\/span>ca  <\/span>utilizatorii  <\/span>cu  <\/span>dre<\/span>pturi \n<\/span>privilegiate  <\/span><\/span>s\u0103 \n<\/span>fie  <\/span>con\u0219tien\u021bi  <\/span>de \n<\/span>riscurile  <\/span>de securitate <\/span>asociate\n<\/span>drepturilor <\/span>lor <\/span>de <\/span>acces <\/span>ridicate. Aceasta <\/span>include <\/span>cuno\u0219tin\u021be <\/span>despre phishing, malware \u0219i alte\namenin\u021b\u0103ri cibernetice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Managemen<\/span>tul accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Utilizatorii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>\u00een\u021beleag\u0103 <\/span>cum <\/span>s\u0103 <\/span>\u00ee\u0219i <\/span>gestioneze <\/span>corect <\/span>drepturile <\/span>de <\/span>acces, <\/span>inclusiv utilizarea <\/span>parolelor <\/span>puternice, <\/span>MF<\/span>A\n\u0219i <\/span>restric\u021bionarea <\/span>accesului\n<\/span>numai <\/span>la <\/span>ceea <\/span>ce <\/span>este necesar pentru rolul lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conformitatea\n\u0219i reglementarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Este\nimportant ca utilizatorii cu drepturi privilegiate s\u0103 cunoasc\u0103 legile \u0219i\nreglement\u0103rile relevante, precum GDPR, Directiva (UE) 2022\/2555 a P<\/span>arlamentului European \u0219i a Consiliului din\n14 decembrie 2022 privind m\u0103suri pentr<\/span>u\nun nivel comun ridicat de securitate cibernetic\u0103 \u00een Uniune, de modificare a\nRegulamentului (UE) nr<\/span>. 910\/2014 \u0219i <\/span>a Directivei (UE) 2018\/1972 \u0219i de abrogare\na D<\/span>irectivei (UE) 2016\/1<\/span>148, denumit\u0103 \u00een continuare Directiva NIS\n2 sau NIS 2<\/span>, Regulamentul (UE)\n2022\/2554 al Parlamentului European <\/span>\u0219i <\/span>al <\/span>Consiliului <\/span>din <\/span>14 <\/span>de<\/span>cembrie <\/span>2022 <\/span>privind <\/span>rezilien\u021ba\n<\/span>opera\u021bional\u0103 <\/span>digital\u0103 a <\/span>sectorului <\/span>financiar <\/span>\u0219i <\/span>de <\/span>modificare <\/span>a <\/span>Regulamentelor <\/span>(CE) <\/span>nr<\/span>. <\/span>1060\/2009, <\/span>(UE<\/span>) <\/span>nr<\/span>.<\/span><\/p>\n\n

648\/2012, <\/span>(UE) <\/span>nr<\/span>. <\/span>600\/2014, <\/span>(UE) <\/span>nr<\/span>. <\/span>909\/2014 <\/span>\u0219i <\/span>(UE) <\/span>2016\/101<\/span>1, <\/span>\u0219i <\/span>modul <\/span>\u00een <\/span>care\nacestea le afecteaz\u0103 activitatea.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>R\u0103spunsul\nla incidente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Instruirea <\/span>privind\n<\/span>modul <\/span>de <\/span>r\u0103spuns\n<\/span>la <\/span>incidentele <\/span>de <\/span>securitate <\/span>este <\/span>esen\u021bial\u0103. <\/span>Aceasta include <\/span>recu<\/span>noa\u0219terea <\/span>activit\u0103\u021bilor <\/span>suspecte <\/span>\u0219i <\/span>cunoa\u0219terea <\/span>modului <\/span>\u0219i <\/span>a <\/span>persoanel<\/span>or <\/span>c\u0103rora\ntrebuie s\u0103 le fie raportate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cele\nmai bune practici de management al datelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Utilizatorii <\/span>ar <\/span>trebui <\/span>instrui\u021bi\n<\/span>cu <\/span>privire <\/span>la <\/span>modul <\/span>de <\/span>stocare, <\/span>prelucrare <\/span>\u0219i <\/span>transfer <\/span>securizat al datelor sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Etica\n\u0219i responsabilitatea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Este\nimportant ca utilizatorii cu drepturi privilegiate s\u0103 fie con\u0219tien\u021bi de\nresponsabilit\u0103\u021bile lor etice \u0219i de posibilele consecin\u021be ale utiliz\u0103rii abuzive\na drepturilor lor de acces.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizatorii <\/span>cu <\/span>drepturi\n<\/span>privilegiate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>evalua\u021bi <\/span>\u0219i <\/span>testa\u021bi <\/span>p<\/span>eriodic <\/span>cu <\/span>privire <\/span>la \u00een\u021belegerea <\/span>practicilor de securitate cibernetic\u0103 pentru rolurile lor\nspecializate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Luarea <\/span>\u00een <\/span>considerare <\/span>a <\/span>or<\/span>ganiz\u0103rii\n<\/span>unor <\/span>activit\u0103\u021bi <\/span>anuale <\/span>de <\/span>perfec\u021bionare <\/span>pentru <\/span>consolidarea\npracticilor existente \u0219i introducerea de noi practici.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[PR.DS]\nSECURITATEA DATELOR<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Datele sunt gestionate \u00een\nconformitate cu strategia de management al riscului a organiza\u021biei pentru\nprotejarea confiden\u021bialit\u0103\u021bii, integrit\u0103\u021bii \u0219i disponibilit\u0103\u021bii informa\u021biilor.<\/span><\/p>\n\n

PR.DS-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Confiden\u021bialitatea, integritatea \u0219i disponibilitatea\ndatelor stocate sunt protejate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nimplementeze <\/span>verific\u0103ri ale\nintegrit\u0103\u021bii so<\/span>ftw<\/span>are<\/span>-ului,\nfirmware-ului \u0219i informa\u021biilor <\/span>pentru <\/span>detec\u021bia <\/span>modific\u0103rilor <\/span>neautorizate <\/span>ale <\/span>com<\/span>ponentelor\n<\/span>critice <\/span>ale sistemului <\/span>s\u0103u \u00een timpul depozit\u0103rii, tra<\/span>nsportului, pornirii \u0219i atunci c\u00e2nd se\nconsider\u0103 necesar.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura integritat<\/span>ea\n\u0219i fiabilitatea componentelor critice ale sistemului, precum software<\/span>-ul, firmware-ul \u0219i datele de configurare,\nprin detec\u021bia modific\u0103rilor neautorizate care ar putea compromite siguran\u021ba<\/span>, fiabilitatea sau securitatea\nopera\u021bional\u0103 \u00een toate etapele ciclului de via\u021b\u0103, inclusiv depozitarea,\ntransportul \u0219i punerea <\/span>\u00een func\u021biune.<\/span><\/p>\n\n

Pentru protejarea \u00een mod\neficace a integrit\u0103\u021bii datelor stocate, organiza\u021bia ar trebui s\u0103 implementeze\nun <\/span>set <\/span>de <\/span>controale <\/span>stratificate, <\/span>proiectate <\/span>pentru <\/span>detec\u021bia <\/span>\u0219i <\/span>prevenirea\n<\/span>modific\u0103rilor neautorizate <\/span>ale\ndatelor stocate, ale software<\/span>-ului \u0219i\nale componentelor sistemului.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea mecanismelor de integritate criptografic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>hash-urilor <\/span>criptografice <\/span>(de <\/span>exemplu, <\/span>SHA-256), <\/span>a <\/span>semn\u0103turilor <\/span>digitale\n<\/span>sau <\/span>a <\/span>altor mecanisme criptografice (de <\/span>exemplu, coduri de autentificare a mesajului <\/span>– MAC) <\/span>pentru\nverificarea integrit\u0103\u021bii datelor stocate \u0219i fi\u0219ierelor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>alorile de integritate ar trebui generate \u00een momentul\nstoc\u0103rii \u0219i verificate \u00eenainte de acce<\/span>sare\nsau executare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea monitoriz\u0103rii automate a integrit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implementarea <\/span>unor <\/span>instrumente <\/span>de <\/span>monitorizare <\/span>a <\/span>integrit\u0103\u021bii <\/span>fi\u0219ierelor <\/span>(FIM) <\/span>pentru <\/span>a <\/span>urm\u0103ri\ncontinuu modific\u0103rile aduse fi\u0219ierelor<\/span>,\nconfigura\u021biilor \u0219i aplica\u021biil<\/span>or\ncritice ale siste<\/span>mului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>generate\n<\/span>alerte <\/span>pentru <\/span>orice <\/span>modific\u0103ri <\/span>neautorizate <\/span>sau <\/span>nea\u0219t<\/span>eptate, <\/span>iar <\/span>jurnalele\n<\/span>ar trebui p\u0103strate pentru audit \u0219i investiga\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>alidarea int<\/span>egrit\u0103\u021bii\nsoftware<\/span>-ului \u0219i firmware-ului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea <\/span>valid\u0103rii <\/span>software<\/span>-ului <\/span>\u0219i <\/span>firmware<\/span>-ului <\/span>stocate <\/span>pe <\/span>sisteme, <\/span>utiliz\u00e2nd\n<\/span>verificarea semn\u0103turii sau mecanisme de pornire securizat\u0103 \u00eenainte de\nexecu\u021bie.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>alidarea <\/span>integrit\u0103\u021bii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fac\u0103 <\/span>parte <\/span>din <\/span>procesul <\/span>de <\/span>pornire <\/span>a <\/span>sistemului\n<\/span>\u0219i <\/span>s\u0103 <\/span>fie <\/span>pus\u0103 \u00een aplicare p<\/span>rin controale tehnice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na controlului modif<\/span>ic\u0103rilor \u0219i\nrestric\u021biilor de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Limitarea <\/span>accesului <\/span>de <\/span>scriere <\/span>la <\/span>datele <\/span>critice\n<\/span>\u0219i <\/span>componentele <\/span>siste<\/span>mului <\/span>prin <\/span>RBAC <\/span>\u0219i principii de privilegii minime.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>modific\u0103rile <\/span>aduse <\/span>datelor <\/span>stocate\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>sup<\/span>use <\/span>procedurilor <\/span>formale <\/span>de management\nal modific\u0103rilor \u0219i jurnalizate pentru <\/span>a\nputea fi monitorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea integrit\u0103\u021bii backup-urilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\n<\/span>mecanisme <\/span>de <\/span>verificare <\/span>a <\/span>integrit\u0103\u021bii <\/span>(de <\/span>exemplu, <\/span>sume <\/span>de\ncontrol sau semn\u0103turi <\/span>digitale)\npentru a asigura c\u0103 nu au fost modificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui\n <\/span><\/span>efectuate\n <\/span><\/span>re<\/span>staur\u0103ri  <\/span><\/span>de  <\/span><\/span>testare  <\/span><\/span>periodice  <\/span><\/span>pentru\n <\/span><\/span>a\n <\/span><\/span>confirma\n <\/span><\/span>integritatea\n <\/span><\/span>\u0219i\nutilizabilitatea datelor de backup.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nimplementeze instrumente automatiz<\/span>ate,\nacolo <\/span>unde este fezabil, pentru a\nfurniza notific\u0103ri \u00een cazul descoperirii unor discrepan\u021be \u00een timpul verific\u0103rii\nintegrit\u0103\u021bii.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Con<\/span>trol este de a asigura detec\u021bia \u0219i\nraportarea automat\u0103 a discrepan\u021belor \u00een integritatea si<\/span>stemului sau a datelor, permi\u021b\u00e2nd o reac\u021bie prompt\u0103 \u0219i reduc\u00e2nd\nriscul de manipulare nedetectat\u0103, \u00een special \u00een medii \u00een care continuitatea\nopera\u021bional\u0103 \u0219i siguran\u021ba sunt critice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103t<\/span>oarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Implementarea <\/span>instrumentelor <\/span>automatizate, <\/span>acolo <\/span>unde <\/span>este fezabil, <\/span>pentru <\/span>a <\/span>verifica\n<\/span>\u00een <\/span>mod continuu integritatea\ndatelor \u0219i sistemelor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Asigurarea <\/span>faptului <\/span>c\u0103 <\/span>aceste <\/span>instrumente <\/span>raporteaz\u0103 <\/span>prompt <\/span>\u00eenc\u0103lc\u0103rile <\/span>integrit\u0103\u021bii, <\/span>atunci <\/span>c\u00e2nd sunt\ndetectate discrepan\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Configurare<\/span>a <\/span>alertelor <\/span>de <\/span>notificare <\/span>pentru\n<\/span>personalul <\/span>relevant, <\/span>precum\n<\/span>administratorii <\/span>de <\/span>sistem, responsabilii <\/span>de <\/span>proces <\/span>\u0219i <\/span>responsabili<\/span>i <\/span>cu <\/span>securitatea <\/span>informa\u021biei, <\/span>pentru <\/span>a <\/span>permite <\/span>investigarea <\/span>\u0219i r\u0103spunsul <\/span>rapid.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizarea <\/span>solu\u021biilor <\/span>de <\/span>verificare a <\/span>integrit\u0103\u021bii <\/span>gestiona<\/span>te <\/span>centralizat <\/span>pentru <\/span>eficientizarea\nmonitoriz\u0103rii \u0219i raport\u0103rii, at\u00e2t \u00een mediile IT<\/span>,\nc\u00e2t \u0219i \u00een mediile OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Urmarea <\/span>recomand\u0103rilor <\/span>ENISA, <\/span>precum\n<\/span>Ghidul <\/span>tehnic <\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de <\/span>c\u0103<\/span>tre ENISA, care prezint\u0103 bunele practici\npentru monitorizarea automat\u0103 a integrit\u0103\u021bii \u0219i r\u0103spunsul la incidente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>defineasc\u0103 <\/span>\u0219i <\/span>s\u0103 <\/span>implementeze <\/span>r\u0103spunsuri <\/span>automate <\/span>la <\/span>\u00eenc\u0103lc\u0103rile <\/span>de <\/span>integritate\ndetectate, <\/span>utiliz\u00e2nd <\/span>m\u0103suri\n<\/span>de <\/span>protec\u021bie <\/span>predefinite, <\/span>propor\u021bion<\/span>ale <\/span>cu <\/span>gravitatea <\/span>\u0219i <\/span>impactul <\/span>\u00eenc\u0103lc\u0103rii. GHID DE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul acestui\nControl este de a minimiza impactul \u00eenc\u0103lc\u0103rilor integrit\u0103\u021bii prin activarea\nunor r\u0103spunsuri rapide, propor\u021bionale \u0219i automate care contr<\/span>ibuie la limitarea <\/span>amenin\u021b\u0103rilor, la men\u021bine<\/span>rea\nstabilit\u0103\u021bii sistemului \u0219i la sus\u021binerea analizei criminalistice, \u00een special \u00een\nmedii \u00een care <\/span>interven\u021bia manual\u0103 poa<\/span>te fi \u00eent\u00e2rziat\u0103 sau nepractic\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een <\/span>considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>definite <\/span>nivelurile <\/span>de <\/span>gravitate <\/span>\u0219i <\/span>ac\u021biunile <\/span>de <\/span>r\u0103spuns, <\/span>\u00eenc\u0103lc\u0103rile <\/span>integrit\u0103\u021bii <\/span>fiind\nclasificate (de exemplu, impact redus, mediu, ridicat) \u0219i corelate cu m\u0103suri de\nprotec\u021bie automate adecvate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Alertele  <\/span>\u0219i \n<\/span>notific\u0103ri<\/span>le  <\/span>ar \n<\/span>trebui  <\/span>declan\u0219ate  <\/span>automat \n<\/span>la  <\/span>detectarea  <\/span>\u00eenc\u0103<\/span>lc\u0103rilor  <\/span>integrit\u0103\u021bii \n<\/span>\u0219i integrate cu platformele SOAR pentru eficientizarea gestion\u0103rii\nincidentelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Componentele <\/span>afectate <\/span>ar <\/span>trebui\n<\/span>carantinate <\/span>sau <\/span>iz<\/span>olate, <\/span>precu<\/span>m <\/span>fi\u0219ierele, <\/span>aplica\u021biile <\/span>sau <\/span>sistemele compromise, pentru prev<\/span>enirea deterior\u0103rii ulterioare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>oate\n<\/span>evenimentele <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fi<\/span>e <\/span>jurnalizate <\/span>\u0219i <\/span>auditabile, <\/span>inclusiv\n<\/span>\u00eenc\u0103lc\u0103rile <\/span>detectate <\/span>\u0219i ac\u021biunile automate, pentru sprijinirea\ninvestiga\u021biilor criminalistice \u0219i raportarea <\/span>conformit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea u\u0219oar\u0103 ar trebui utilizat\u0103 acolo unde\neste posibil, precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Blocarea\nanumitor procese sau utili<\/span>zatori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revenirea\nla o configura\u021bie cunoscut\u0103 ca fiind bun\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dezactivarea\ntemporar\u0103 a serviciilor afectate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Mecanismele <\/span>de <\/span>r\u0103spuns <\/span>ar <\/span>trebui <\/span>tes<\/span>tate <\/span>\u0219i <\/span>ajusta<\/span>te <\/span>periodic <\/span>\u00een <\/span>medii <\/span>controlate <\/span>pentru <\/span>asigurarea eficacit\u0103\u021bii\n\u0219i evit\u0103rii \u00eentreruperilor inutile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ar <\/span>trebui <\/span>consultate <\/span>reco<\/span>mand\u0103rile <\/span>E<\/span>NISA <\/span>din <\/span>Ghidul <\/span>de <\/span>implementare <\/span>a <\/span>m\u0103surilor <\/span>de <\/span>securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(pentru\nconsultare public\u0103, documentul nr<\/span>.\nENISA\/2024\/IGSM).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\ndefineasc\u0103 \u0219i s\u0103 pun\u0103 \u00een aplicare politici clare \u0219i m\u0103suri practice de\nprotec\u021bie pentru gestionarea \u0219i restric\u021bionarea utiliz\u0103rii suporturilor de\nstocare portabile, \u00een vederea reducerii riscului de scurgeri de <\/span>date, acces neautorizat \u0219i introducerea de\nmalware.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>riscu<\/span>l <\/span>de <\/span>scurgere\n<\/span>de <\/span>date, <\/span>acces <\/span>neautorizat <\/span>\u0219i <\/span>introducere\nde malware prin definir<\/span>ea \u0219i\naplicarea unor politici \u0219i m\u0103suri de <\/span>protec\u021bie\nclare privind utilizarea suporturilor de stocare portabile.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea \u0219i comunicarea politicii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>stabilit\u0103 <\/span>o <\/span>politic\u0103 <\/span>documentat\u0103 <\/span>privind <\/span>utilizarea <\/span>acce<\/span>ptabil\u0103 <\/span>a <\/span>dispozitivelor <\/span>de stocare portabile (de exemplu,\ndispozitive USB, carduri SD, hard disk-uri externe).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politica <\/span>ar <\/span>tr<\/span>ebui <\/span>comunicat\u0103 <\/span>\u00een <\/span>timpul <\/span>procesului <\/span>de <\/span>integrare <\/span>or<\/span>ganiza\u021bional\u0103 <\/span>\u0219i <\/span>consolidat\u0103\nprin instruiri periodice pentru con\u0219tientizare \u00een <\/span>domeniul securit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controlul utiliz\u0103rii dispozitivelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui pe<\/span>rmise doar dispozitivele de\nstocare portabile aprobate de or<\/span>ganiza\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>men\u021binut  <\/span><\/span>un  <\/span><\/span>inventar\n <\/span><\/span>al\n <\/span><\/span>dispozitivelor\n <\/span><\/span>aprobate\n <\/span><\/span>asociat\n <\/span><\/span>cu\n <\/span><\/span>utilizatori\n <\/span><\/span>sau\ndepartamente specifice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea m\u0103surilor de protec\u021bie practice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Controlul  <\/span><\/span>accesului:  <\/span><\/span>Dispozitivele  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>solicite\n <\/span><\/span>autentificarea\n <\/span><\/span>utilizatorului\n <\/span><\/span>(de\nexemplu, pr<\/span>otec\u021bie prin parol\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Criptarea: <\/span>Datele <\/span>de <\/span>pe <\/span>dispozitivele <\/span>portabile <\/span>ar <\/span>trebui <\/span>criptate <\/span>folosind\n<\/span>unit\u0103\u021bi <\/span>criptate hardware sau\ninstrumente software precum BitLocker <\/span>T<\/span>o Go sau\n<\/span>V<\/span>eraCrypt.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modul <\/span>numai <\/span>pentru <\/span>citire: <\/span>Dispozitivele <\/span>utilizate <\/span>pentru <\/span>distribu\u021bie <\/span>(de <\/span>exemplu, <\/span>actualiz\u0103ri de software) ar trebui\nconfigurate doar pentru modul numai pentru citire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Scanarea  <\/span><\/span>malware-ului:  <\/span><\/span>Dispozitivele  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>scanate\n <\/span><\/span>pentru\n <\/span><\/span>malware\n <\/span><\/span>\u00eenainte\n <\/span><\/span>\u0219i\n <\/span><\/span>dup\u0103\nutilizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Securitatea <\/span>fizic\u0103: <\/span>Dispozitivele <\/span>ar <\/span>trebui <\/span>depozitate\n<\/span>\u00een <\/span>mod <\/span>securizat <\/span>(de <\/span>exemplu,\n<\/span>\u00een <\/span>sertare sau dulapuri\n\u00eencuiate) atunci <\/span>c\u00e2nd nu sunt\nutilizate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219<\/span>i\njurnalizarea utiliz\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pe <\/span>sistemele <\/span>gestionate, <\/span>conexiunile <\/span>dispozitivelor <\/span>USB <\/span>\u0219i <\/span>transferurile <\/span>de <\/span>fi\u0219iere <\/span>ar <\/span>trebui\njurnalizate folosind instrumente de <\/span>management\nal endpoint<\/span>-urilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnalele\nar trebui revizuite periodic pentru de<\/span>tec\u021bia <\/span>utiliz\u0103rii neautorizate sau a anomaliilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Exemple<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un <\/span>tehnician <\/span>de <\/span>teren <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>utilizeze <\/span>un <\/span>dispozitiv <\/span>USB <\/span>cript<\/span>at, <\/span>furn<\/span>izat <\/span>de <\/span>or<\/span>ganiza\u021bie,\npentru colectarea datelor de la senzori la distan\u021b\u0103<\/span>. Unitatea ar trebui scanat\u0103 \u00eenainte \u0219i dup\u0103 utilizare, iar\ndatele ar trebui \u00eenc\u0103rcate pe un server securizat la \u00eentoarcere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>O <\/span>echip\u0103 <\/span>de <\/span>marketing <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>utilizez<\/span>e <\/span>un <\/span>dispozitiv\n<\/span>USB <\/span>cu <\/span>acces <\/span>numai <\/span>pentru <\/span>citire\npentru <\/span>distribuirea <\/span>materialelor <\/span>promo\u021bionale la <\/span>t\u00e2r<\/span>guri <\/span>\u0219i <\/span>expozi\u021bii, <\/span>\u00eempiedic\u00e2nd <\/span>astfel\ncopierea datelor \u00eenapoi <\/span>pe dispozitiv<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-01.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\npermit\u0103 <\/span>utiliz<\/span>area mediilor amovibile numai atunci c\u00e2nd este absolut necesar\n\u0219i <\/span>trebuie <\/span>s\u0103 <\/span>pun\u0103 <\/span>\u00een <\/span>aplicare <\/span>m\u0103suri <\/span>tehnice <\/span>pentru <\/span>a <\/span>bloca executarea <\/span>automat\u0103 <\/span>a <\/span>fi\u0219ierelor\n<\/span>de <\/span>pe aceste dispozitive.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de a <\/span>minimiza <\/span>suprafa\u021ba\n<\/span>de <\/span>atac <\/span>\u00een <\/span>mediile <\/span>opera\u021bionale <\/span>\u0219i <\/span>IT <\/span>prin limitarea <\/span>strict\u0103 <\/span>a <\/span>utiliz\u0103rii <\/span>mediilor <\/span>amovibile <\/span>\u0219i <\/span>prevenirea <\/span>execut\u0103rii <\/span>automate <\/span>a <\/span>fi\u0219ierelor <\/span>poten\u021bial d\u0103un\u0103toare.<\/span><\/p>\n\n

Pentru <\/span>a <\/span>reduce <\/span>riscul <\/span>de <\/span>infectare\n<\/span>cu <\/span>malware <\/span>\u0219i <\/span>de <\/span>scurgere\n<\/span>de <\/span>date prin <\/span>mediile\n<\/span>amovibile <\/span>(de exemplu, <\/span>dispozitive <\/span>U<\/span>SB, <\/span>unit\u0103\u021bi <\/span>externe <\/span>de <\/span>memorie), <\/span>organiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia\n\u00een <\/span>considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Permiterea u<\/span>tiliz\u0103rii\ndoar atunci c\u00e2nd este necesar<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>precizeze <\/span>\u00een <\/span>politica <\/span>sa <\/span>c\u0103 <\/span>mediile <\/span>amovibile <\/span>ar <\/span>trebui <\/span>utiliz<\/span>ate <\/span>doar atunci <\/span>c\u00e2nd <\/span>nu <\/span>exist\u0103\n<\/span>o <\/span>alternativ\u0103 <\/span>mai <\/span>securizat\u0103 <\/span>(de <\/span>exemplu, <\/span>transferul <\/span>securizat <\/span>de <\/span>fi\u0219iere)<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizate\n<\/span>instrumente <\/span>tehnice <\/span>pentru <\/span>li<\/span>mitarea\n<\/span>accesulu<\/span>i <\/span>la <\/span>port<\/span>urile <\/span>USB <\/span>sau <\/span>pentru\nsolicitarea aprob\u0103rii \u00eenainte de utilizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dezactivarea func\u021biilor de rulare \u0219i execu\u021bie automat\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate <\/span>sistemele <\/span>ar <\/span>trebui <\/span>configurate <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>dezactiveze <\/span>func\u021biile\n<\/span>de <\/span>rulare <\/span>automat\u0103\n<\/span>\u0219i redare automat\u0103, pentru ca fi<\/span>\u0219ierele\nde pe mediile amovibile s\u0103 nu fie executate automat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceasta  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>contribuie\n <\/span><\/span>la\n <\/span><\/span>prevenirea\n <\/span><\/span>execut\u0103rii\n <\/span><\/span>malwa<\/span>re<\/span>-ului\n <\/span><\/span>f\u0103r\u0103\n <\/span><\/span>ac\u021biunea\nutilizatorului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea instrumentelor de securitate pentru con<\/span>trolul accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021bia ar trebui s\u0103 utilizeze instrumente\nde protec\u021bie a endpoint<\/span>-urilor\npentru:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Blocarea\nsau limitarea accesului USB.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Permiterea\nu<\/span>tiliz\u0103rii doar a dispozitivelor\naprobate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Solicitarea\naprob\u0103rii administratorului pentru dispozitivele noi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i revizuirea utiliz\u0103ri<\/span>i<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021bia  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>s\u0103\n <\/span><\/span>monitorizeze\n <\/span><\/span>utilizarea\n <\/span><\/span>mediilor\n <\/span><\/span>amovibile\n <\/span><\/span>prin\n <\/span><\/span>jurnalizarea\nconexiunilor dispozitivelor prin intermediul instrumentelor de protec\u021bie a\nendpoint<\/span>-urilor sau al <\/span>jurnalelor <\/span>sistemului <\/span>de <\/span>operare.\n<\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>ar <\/span>trebui <\/span>utilizate\np<\/span>roceduri <\/span>de <\/span>jurnalizare<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

manual\u0103  <\/span><\/span>sau  <\/span><\/span>de  <\/span><\/span>acces\n <\/span><\/span>controlat.\n <\/span><\/span>Jurnalele\n <\/span><\/span>ar\n <\/span><\/span>tr<\/span>ebui  <\/span><\/span>revizuite  <\/span><\/span>periodic  <\/span><\/span>pentru\n <\/span><\/span>detec\u021bia\nactivit\u0103\u021bilor <\/span>neautorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Exemplu:  <\/span>Echipa \n<\/span>financiar\u0103  <\/span>ar  <\/span>tre<\/span>bui  <\/span>s\u0103 \n<\/span>utilizeze  <\/span>dispozitive  <\/span>USB \n<\/span>criptate,  <\/span>aprobate  <\/span>de or<\/span>ganiza\u021bie, <\/span>pentru <\/span>transferu<\/span>l <\/span>rapoartelor <\/span>confiden\u021biale. Aceste <\/span>unit\u0103\u021bi <\/span>ar <\/span>trebui <\/span>scanate <\/span>\u00eenaintea utiliz\u0103rii, func\u021bia de executare\nautomat\u0103 ar treb<\/span>ui dezactivat\u0103 pe toate\nsistemele, iar accesul ar trebui jurnalizat \u0219i revizuit.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Clarificarea diferen\u021bei fa\u021b\u0103 de\nPR.DS-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>PR.DS-01.4 <\/span>se <\/span>concentreaz\u0103 <\/span>pe <\/span>stabilirea <\/span>regulilor\n<\/span>\u0219i <\/span>procedurilor <\/span>privind\n<\/span>modul <\/span>\u00een <\/span>care <\/span>ar <\/span>trebui utilizate mediile amovibile (de\nexemplu, cine le poate utiliza, criptarea, p<\/span>rotec\u021bia\nfizic\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>PR.DS-01.5 <\/span>se <\/span>concentreaz\u0103 <\/span>pe <\/span>pun<\/span>erea <\/span>\u00een <\/span>aplicare\n<\/span>tehnic\u0103 <\/span>a <\/span>ace<\/span>stor <\/span>norme\n<\/span>– <\/span>modul <\/span>\u00een <\/span>care\nsistemele ar trebui configurate pentru reducerea riscurilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-01.6<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 protejeze confiden\u021bialitatea\nactivelor <\/span>sale critice \u00een stare de\nrepaus.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nas<\/span>igura <\/span>c\u0103 <\/span>datele <\/span>opera\u021bionale <\/span>\u0219i <\/span>ale <\/span>activit\u0103\u021bii <\/span>sensibile <\/span>stocate pe\nsisteme, servere sau dispozitive r\u0103m\u00e2n protejate \u00eempotriva accesului\nneautorizat, chiar \u0219i \u00een cazul \u00een care securitatea fizic\u0103 sau logic\u0103 este\ncompromis\u0103.<\/span><\/p>\n\n

\u00cen <\/span>mediile <\/span>OT, <\/span>unde <\/span>sistemele <\/span>vechi <\/span>\u0219i <\/span>infrastructura <\/span>partajat\u0103 <\/span>sunt <\/span>comune,\n<\/span>protejarea <\/span>datelor <\/span>stocate este <\/span>critic\u0103 <\/span>pentru <\/span>prevenirea\n<\/span>expunerii <\/span>fi\u0219ierelor <\/span>de <\/span>configurare, <\/span>a <\/span>datelor\nde <\/span>proces <\/span>sau <\/span>a <\/span>datelor <\/span>de\nacces care ar putea fi exploatate pentru perturbarea opera\u021biunilor sau pentru o<\/span>b\u021binerea accesului lateral.<\/span><\/p>\n\n

Acest Control se bazeaz\u0103 pe PR.DS-01.1.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru a permite protejarea\nactivelor critice ale organiza\u021biei \u00een stare de repaus, ar tr<\/span>ebui luate \u00een considerare urm\u0103toarele\ntehnici:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Criptarea: <\/span>Criptarea <\/span>datelor <\/span>stocate\n<\/span>pe <\/span>hard <\/span>disk<\/span>-uri, <\/span>pe <\/span>supo<\/span>rturi <\/span>externe, <\/span>\u00een <\/span>fi\u0219iere <\/span>stocate,\n<\/span>\u00een fi\u0219iere de configurare \u0219i stocate \u00een cloud, utiliz\u00e2nd algoritmi de\ncriptare puternici pentru prevenirea accesului neautorizat \u0219i protejarea\ndatelor \u00eempotriva modific\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Controale <\/span>de <\/span>acces: <\/span>Implementarea <\/span>cont<\/span>roalelor <\/span>stricte\n<\/span>de <\/span>acces <\/span>pentru\n<\/span>a <\/span>asigura <\/span>c\u0103 <\/span>numai\npersonalul autorizat poate accesa informa\u021biile sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Audituri  <\/span><\/span>periodice:  <\/span><\/span>Efectuarea\n <\/span><\/span>de\n <\/span><\/span>audituri\n <\/span><\/span>de\n <\/span><\/span>securitate  <\/span>periodice  <\/span><\/span>pentru  <\/span><\/span>identificarea  <\/span><\/span>\u0219i\nremedierea <\/span>vulnerabilit\u0103\u021bilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Mascarea <\/span>datelor: <\/span>Utiliz<\/span>area <\/span>tehnicilor <\/span>de <\/span>mascare <\/span>a <\/span>datelor <\/span>pentru <\/span>ascunderea <\/span>informa\u021biilor sensibile <\/span>\u00een <\/span>medii <\/span>care <\/span>nu <\/span>sunt <\/span>de <\/span>produc\u021bie\n<\/span>(de exemplu, <\/span>datele <\/span>sensibil<\/span>e <\/span>din <\/span>punct\nde <\/span>vedere <\/span>al GDPR <\/span>din <\/span>mediul\n<\/span>de <\/span>produc\u021bie <\/span>nu <\/span>pot <\/span>fi <\/span>copiate <\/span>\u00eentr<\/span>-un <\/span>mediu\n<\/span>de <\/span>testare <\/span>f\u0103r\u0103 <\/span>randomizare, <\/span>pentru prevenirea accesului neautorizat\nla date).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-01.9<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activele organiza\u021biei trebuie s\u0103 fie casate \u00een mod\nsecurizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a asigura c\u0103 <\/span>toate <\/span>activele <\/span>organiza\u021biei <\/span>sunt <\/span>casate <\/span>\u00eentr<\/span>-o <\/span>manier\u0103 securizat\u0103 <\/span>\u0219i <\/span>controlat\u0103, <\/span>pentru <\/span>a <\/span>preveni\n<\/span>accesul <\/span>neautorizat <\/span>la date\n<\/span>sensibile <\/span>referitoare <\/span>la <\/span>activitate,\ndate personale sau date opera\u021bionale.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sanitizarea datelor \u00eenaint<\/span>e de casare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>sensibile <\/span>ar <\/span>trebui <\/span>eliminate\n<\/span>\u00een <\/span>mod <\/span>securizat <\/span>(\u201e\u0219terse <\/span>\u00een <\/span>mod <\/span>securizat”) <\/span>de <\/span>pe <\/span>toate activele, precum computere, servere,\nhard disk<\/span>-uri, dispozitive USB,\ndispozitive mobile \u0219i documente pe h\u00e2rtie, \u00eenainte de scoaterea din uz,\nreatribui<\/span>re, reparare sau \u00eenlocuire.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea metodelor adecvate de distrugere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>metode <\/span>adecvate <\/span>pentru <\/span>distrugerea <\/span>documentelor <\/span>pe <\/span>h\u00e2rtie, <\/span>a <\/span>suporturilor\nde stocare digitale \u0219i a altor suporturi fizice de date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Activarea \u0219ter<\/span>gerii\nsecurizate la <\/span>distan\u021b\u0103 pentru\ndispozitivele <\/span>mobile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Capabilit\u0103\u021bile <\/span>de <\/span>\u0219ter<\/span>gere <\/span>securizat\u0103 <\/span>la <\/span>distan\u021b\u0103 <\/span>ar <\/span>trebui <\/span>activate\n<\/span>pe <\/span>laptopuri, <\/span>tablete,\n<\/span>telefoane \u0219i alte dispo<\/span>zitive\nmobile pentru a proteja datele \u00een cazul pierderii sau furtului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Gestionarea cu aten\u021bie a numelor de domenii expirate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Domeniile <\/span>expirate <\/span>ar <\/span>tr<\/span>ebui <\/span>protejate, <\/span>deoarece\n<\/span>sunt <\/span>adesea <\/span>\u021binta <\/span>infractorilor <\/span>cibernetici. <\/span>Ar trebui luate \u00een considerare urm\u0103toarele practici:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Activarea <\/span>re<\/span>\u00eennoirii <\/span>automate\n<\/span>sau <\/span>re\u00eennoirea <\/span>domeniilor <\/span>pentru <\/span>o <\/span>perioad\u0103\n<\/span>de <\/span>cel <\/span>pu\u021bin zece ani.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Comunicare<\/span>a clar\u0103 a modific\u0103rilor de domeniu \u0219i\ngestionarea intern\u0103 a tranzi\u021biilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Setarea\nunor r\u0103spunsuri automate pentru e-mailurile trimise c\u0103tre domeniile vechi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Actualizarea\nreferin\u021belor online \u0219i a set\u0103rilor din serviciile cloud.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Modificarea\nsau \u0219ter<\/span>gerea conturilor \u00eenregistrate\ncu domenii vechi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Men\u021binerea <\/span>actualizat\u0103 <\/span>a <\/span>adreselor <\/span>de <\/span>e<\/span>–<\/span>mail <\/span>folosite\n<\/span>pentru <\/span>autentificare <\/span>\u0219i <\/span>activarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

MF<\/span>A.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Evitarea\nutiliz\u0103rii unor solu\u021bii neaprobate de stocare \u00een cloud pentru date sensibile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Respectarea <\/span>bunelor\nprac<\/span>tici de <\/span>management al activelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>a <\/span>sprijini\n<\/span>casarea <\/span>securizat\u0103, <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>recomand\u0103ri <\/span>din <\/span>surse <\/span>de <\/span>\u00eencredere, precum <\/span>\u0219ablonul <\/span>de <\/span>Politic\u0103 <\/span>pentru <\/span>managementul <\/span>activelor <\/span>din <\/span>Setul <\/span>de <\/span>instrumente <\/span>CyFun<\/span><\/p>\n\n

\u00ae de pe www<\/span>.cyfun.eu.<\/span><\/a><\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea activelor OT <\/span>\u00een planificarea cas\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>\u0219i <\/span>dispozitivele <\/span>OT <\/span>ar <\/span>trebui <\/span>incluse <\/span>\u00een <\/span>procedurile <\/span>de <\/span>casare, <\/span>asigur\u00e2ndu<\/span>-se <\/span>c\u0103 datele\n<\/span>opera<\/span>\u021bionale <\/span>\u0219i <\/span>configura\u021biile <\/span>sunt <\/span>eliminate <\/span>\u00een <\/span>mod <\/span>securizat\n<\/span>\u00eenainte <\/span>de <\/span>scoatere\n<\/span>din <\/span>uz \u0219i dezafectare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Confiden\u021bialitatea, integritatea \u0219i disponibilitatea\ndatelor \u00een tranzit sunt protejate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Dispozitivele de stocare portabile\ncare con\u021bin date de sistem trebuie controlate \u0219i <\/span>protejate \u00een timpul transportului \u0219i depozit\u0103rii.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a preveni accesul neautori<\/span>zat,\nmodificarea sau pierderea datelor critice ale sistemului, atunci c\u00e2nd\ndispozitivele de stocare portabile sunt mutate \u00eentre loca\u021bii sau stocate \u00een\nafara mediilor securizate.<\/span><\/p>\n\n

\u00cen <\/span>mediile <\/span>OT, <\/span>unde <\/span>datele <\/span>pot <\/span>fi\ntransferate \u00eentre <\/span>sisteme <\/span>izolate\n<\/span>sau <\/span>site<\/span>-uri <\/span>la <\/span>distan\u021b\u0103\n<\/span>folosind suporturi fizice, protejarea acestor dispozitive este esen\u021bial\u0103 <\/span>pentru men\u021binerea integrit\u0103\u021bii \u0219i\nconfiden\u021bialit\u0103\u021bii sistemului.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui <\/span>obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Scanarea <\/span>tuturor <\/span>dispozitivelor <\/span>de <\/span>stocare <\/span>portabil<\/span>e <\/span>\u00een <\/span>c\u0103utarea <\/span>de <\/span>coduri <\/span>cu <\/span>scop <\/span>nelegitim\n<\/span>\u00eenainte de utilizarea \u00een sistemele or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Criptarea <\/span>datelor <\/span>pentru <\/span>asigurarea <\/span>confiden\u021bialit\u0103\u021bii <\/span>\u00een <\/span>ca<\/span>zul <\/span>pierderii <\/span>sau <\/span>furtului <\/span>unui <\/span>dispozitiv<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea sigiliilor inviolabile \u0219i containerelor\n\u00eencuiate \u00een timpul transportului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Apelarea <\/span>la <\/span>curieri\n<\/span>de <\/span>\u00eencredere <\/span>sau <\/span>servicii <\/span>de <\/span>transport <\/span>securizate <\/span>\u0219i <\/span>evitarea <\/span>l\u0103s\u0103rii\n<\/span>dispozitivelor nesupravegheate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Limitarea  <\/span><\/span>accesului  <\/span><\/span>la  <\/span><\/span>dispozitivele  <\/span><\/span>stocate\n <\/span><\/span>la\n <\/span><\/span>personalul\n <\/span><\/span>autorizat,\n <\/span><\/span>cu\n <\/span><\/span>sprijinul\n <\/span><\/span>politicilor\ndocumentate de control al accesului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Depozitarea dispozitivelor\n<\/span>\u00een <\/span>medii <\/span>securizate, <\/span>cu <\/span>climat <\/span>controlat, <\/span>pentru prevenirea <\/span>deterior\u0103rii\nfizice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Efectuarea <\/span>de <\/span>audituri\n<\/span>periodice <\/span>\u0219i <\/span>verific\u0103ri <\/span>ale <\/span>inventarului <\/span>pentru <\/span>a <\/span>asigura\n<\/span>contabilizarea <\/span>\u0219i securizarea\ncorespunz\u0103toare a dispozitivelor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 protejeze informa\u021biile sale\ncritice \u0219i sensibile \u00een timpul tranzitului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de a <\/span>asigura <\/span>confiden\u021bialitatea <\/span>\u0219i <\/span>nealterarea\ninforma\u021biilor <\/span>critice \u0219i sensibile <\/span>\u00een <\/span>timpul <\/span>transmiterii <\/span>prin re\u021bele <\/span>sau <\/span>\u00eentre <\/span>sisteme, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>medii <\/span>\u00een <\/span>care <\/span>fluxurile\n<\/span>de date circul\u0103 \u00eentre straturil<\/span>e\nIT \u0219i OT sau \u00eentre site-uri la distan\u021b\u0103.<\/span><\/p>\n\n

\u00cen <\/span>contextel<\/span>e <\/span>OT, <\/span>\u00een <\/span>care <\/span>datele <\/span>po<\/span>t <\/span>traversa\n<\/span>canale <\/span>de <\/span>comunica\u021bii <\/span>mai <\/span>pu<\/span>\u021bin <\/span>securizate <\/span>sau <\/span>vechi <\/span>(de exemplu, <\/span>\u00eentre <\/span>sisteme <\/span>de <\/span>control, <\/span>dispozitive <\/span>de <\/span>teren <\/span>sau <\/span>sta\u021bii <\/span>de <\/span>monitorizare <\/span>la <\/span>distan\u021b\u0103), <\/span>protec\u021bia \u00een <\/span>timpul <\/span>tr<\/span>anzitului <\/span>este <\/span>esen\u021bial\u0103 pentru <\/span>prevenirea <\/span>intercept\u0103rii, <\/span>manipul\u0103rii <\/span>sau <\/span>scurgerii <\/span>de informa\u021bii. Acest Control se bazeaz\u0103 \u00een\ncontinuare pe PR.DS<\/span>-01.1.<\/span><\/p>\n\n

Pentru <\/span>a <\/span>permite <\/span>protejarea <\/span>informa\u021biilor <\/span>critice <\/span>\u0219i <\/span>sensibile <\/span>ale <\/span>organiza\u021biei <\/span>\u00een <\/span>timpul <\/span>tran<\/span>zitului, <\/span>ar trebui luate \u00een considerare urm\u0103toarele\ntehnici:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Criptarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>protocoalelor <\/span>de <\/span>criptare <\/span>puternice, <\/span>prec<\/span>um <\/span>TLS <\/span>sau <\/span>stratul\n<\/span>de <\/span>socluri <\/span>securizate (SSL), <\/span>pentru <\/span>criptarea <\/span>datelor\n<\/span>\u00een <\/span>timpul <\/span>transmiterii. A<\/span>stfel, <\/span>chiar <\/span>dac\u0103 <\/span>datele <\/span>sunt interceptate, ele r\u0103m\u00e2n ilizibile\npentru persoanele neautorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>E2EE<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implementarea <\/span>E2EE, <\/span>care <\/span>cripteaz\u0103 <\/span>datele <\/span>pe <\/span>dispozitivul <\/span>expeditorului <\/span>\u0219i <\/span>le <\/span>decripteaz\u0103\nnumai pe dispozitivul destinatarului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>M<\/span>F<\/span>A<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Solicitarea\nMF<\/span>A\n<\/span>pentru accesarea informa\u021biilor sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Politici de parole puternice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Punerea <\/span>\u00een <\/span>aplicare\n<\/span>a <\/span>politicilor <\/span>de <\/span>parole <\/span>puternice, <\/span>inclusiv <\/span>utilizarea <\/span>de <\/span>parole <\/span>complexe\n<\/span>\u0219i actualiz\u0103ri <\/span>regulate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>VPN<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>VPN <\/span>– <\/span>fie <\/span>site-to-site, <\/span>fie <\/span>cu <\/span>acces\n<\/span>la <\/span>distan\u021b\u0103 <\/span>– <\/span>pentru <\/span>stabilirea <\/span>unor <\/span>tuneluri\nsecurizate pentru transmiterea date<\/span>lor<\/span>, \u00een speci<\/span>al \u00een cazul conect\u0103rii prin re\u021bele nesigure, precum <\/span>W<\/span>i<\/span>-Fi-ul public.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Audituri de securitate periodice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea  <\/span> <\/span><\/span>de  <\/span> <\/span><\/span>audituri  <\/span> <\/span><\/span>de \n<\/span> <\/span><\/span>securitate  <\/span> <\/span><\/span>periodice  <\/span> <\/span><\/span>pentru \n<\/span> <\/span><\/span>identificarea  <\/span> <\/span><\/span>\u0219i \n<\/span> <\/span><\/span>remedierea vulnerabilit\u0103\u021bilor din\nprocesele de <\/span>transmitere a datelor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-10<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Confiden\u021bialitatea, integritatea \u0219i disponibilitatea\ndatelor <\/span>utiliz<\/span>ate sunt protejate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-10.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Sistemele <\/span>critice <\/span>ale <\/span>o<\/span>rganiza\u021biei <\/span>trebuie <\/span>protejate <\/span>\u00eempotriva <\/span>atacurilor <\/span>de <\/span>ti<\/span>p <\/span>denial<\/span>-of-service <\/span>(DoS)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

sau, cel <\/span>pu\u021bin,\nefectul acestor atacuri trebuie limitat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 sistemele critice r\u0103m\u00e2n disponibile \u0219i opera\u021bionale chiar <\/span>\u0219i <\/span>atunci <\/span>c\u00e2nd <\/span>sunt <\/span>\u021binta <\/span>unor <\/span>atacuri\n<\/span>de <\/span>tip <\/span>DoS, <\/span>care <\/span>au <\/span>ca <\/span>scop <\/span>supra\u00eenc\u0103rcarea <\/span>sau <\/span>\u00eentreruperea\nserviciilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Limitarea impactului atacurilor DoS prin:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implementarea <\/span>de <\/span>dispozitive <\/span>sau <\/span>servicii <\/span>de <\/span>protec\u021bie <\/span>a <\/span>grani\u021belor <\/span>care <\/span>filtreaz\u0103 <\/span>t<\/span>raficul <\/span>cu scop nelegitim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea <\/span>unei <\/span>capacit\u0103\u021bi <\/span>\u0219i <\/span>redundan\u021be <\/span>suficiente <\/span>a <\/span>re\u021belei <\/span>pentru <\/span>a <\/span>absorbi\n<\/span>v\u00e2rfurile <\/span>de <\/span>trafic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Restric\u021biona<\/span>rea\ncapacit\u0103\u021bii de a lansa atacuri DoS prin:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Limitarea  <\/span><\/span>op\u021biunilor  <\/span><\/span>de  <\/span><\/span>conectivitate  <\/span><\/span>pentru\n <\/span><\/span>prevenirea\n <\/span><\/span>transmisiilor\n <\/span><\/span>ne<\/span>autorizate  <\/span><\/span>prin conexiuni cu fir<\/span>, wireless sau prin satelit.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aplicarea\nlimitelor de utilizare a resurselor pentru prevenirea supra\u00eenc\u0103rc\u0103rii\nsistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aplicarea <\/span>unei <\/span>autentific\u0103ri <\/span>\u0219i <\/span>autoriz<\/span>\u0103ri <\/span>puternice <\/span>pentru\n<\/span>a <\/span>controla <\/span>accesul\n<\/span>la <\/span>func\u021biile <\/span>critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Consolidarea rezilien\u021bei sistemului p<\/span>rin:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Efectuarea <\/span>de <\/span>teste <\/span>\u0219i <\/span>audituri\n<\/span>de <\/span>securitate <\/span>periodice\n<\/span>pentru <\/span>identificarea <\/span>\u0219i <\/span>remedierea\nvulnerabilit\u0103\u021bilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea <\/span>traficului <\/span>de <\/span>re\u021bea <\/span>pentru\n<\/span>anomalii <\/span>care <\/span>ar <\/span>putea <\/span>indica\n<\/span>semne <\/span>timpurii <\/span>ale <\/span>unei\ntentative <\/span>de <\/span>DoS.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii specifice O<\/span>T<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>unde <\/span>disponibilitatea <\/span>afecteaz\u0103\n<\/span>\u00een <\/span>mod <\/span>direct <\/span>siguran\u021ba <\/span>\u0219i <\/span>produc\u021bia, <\/span>chiar <\/span>\u0219i\n\u00eentreruperile scurte <\/span>pot <\/span>avea <\/span>consecin\u021be <\/span>grave. <\/span>Protec\u021biile <\/span>Do<\/span>S <\/span>trebuie <\/span>adaptate <\/span>protocoalelor industriale \u0219i sistemelor\nvechi, <\/span>asigur\u00e2nd c\u0103 m\u0103surile de\nap\u0103rare nu interfereaz\u0103 cu opera\u021biunile \u00een timp real.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-11<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Backup-urile datelor sunt create, protejate, men\u021binute\n\u0219i testate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-11.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Backup-urile <\/span>datelor <\/span>critice <\/span>pentru <\/span>activitatea <\/span>organiza\u021biei <\/span>tr<\/span>ebuie <\/span>efectuate\n<\/span>\u0219i <\/span>stocat<\/span>e <\/span>pe <\/span>un <\/span>sistem\ndiferit de dispozitivul pe care se afl\u0103 datele originale.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 datele critice pentru activitate sunt salvate\nperiodic \u0219i stocate \u00een mod securizat pe un sistem separat, pentru a <\/span>le proteja \u00eempotriva pierderii,\ndefec\u021biunilor sistemului sau atacurilor cibernetice, precum ransomware.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Realizarea backup<\/span>-urilor\ndatelor \u0219i sistemelor critice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile\nar trebui s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Date <\/span>critice\n<\/span>pentru <\/span>activitate <\/span>(de <\/span>exemplu, <\/span>\u00eenregistr\u0103ri <\/span>ale <\/span>clien\u021bilor<\/span>, <\/span>date <\/span>financiare <\/span>\u0219i opera\u021bionale<\/span>).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Date <\/span>de <\/span>sistem, <\/span>precum\n<\/span>configura\u021bii <\/span>software, <\/span>set\u0103ri\n<\/span>ale <\/span>dispozitivelor<\/span>, <\/span>documenta\u021bie <\/span>\u0219i backup-uri ale aplica\u021biilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea unei strategii de backup<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele\ncritice ar trebui s\u0103 fie copiate \u00een mod continuu sau aproape \u00een timp real.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Alte\ndate importante ar trebui s\u0103 fie copiate la intervale regulate, convenite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile <\/span>ar <\/span>trebui <\/span>stocate\n<\/span>pe <\/span>un <\/span>sistem <\/span>s<\/span>eparat <\/span>fizic <\/span>sau <\/span>logic <\/span>de <\/span>sursa <\/span>original\u0103\n<\/span>de <\/span>date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceasta <\/span>\u00eense<\/span>amn\u0103 <\/span>c\u0103 <\/span>nu <\/span>trebuie\n<\/span>s\u0103 <\/span>se <\/span>afle <\/span>pe <\/span>acela\u0219i\n<\/span>dispozitiv <\/span>sau <\/span>server\n<\/span>de <\/span>stocare <\/span>ca <\/span>datele\noriginale. \u00cen mod ideal, backup<\/span>-urile\nar trebui stocate \u00eentr<\/span>-o zon\u0103 de\nsecuritate diferit\u0103, un segment <\/span>de <\/span>re\u021b<\/span>ea <\/span>diferit sau <\/span>chiar <\/span>\u00eentr<\/span>-o <\/span>loca\u021bie <\/span>extern\u0103, <\/span>pentru <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>r\u0103m\u00e2n <\/span>accesibile \u0219i <\/span>necompromise <\/span>\u00een <\/span>cazul <\/span>unei <\/span>defec\u021biuni <\/span>a <\/span>sistemului, <\/span>al <\/span>unui <\/span>atac ransomware <\/span>sau <\/span>al <\/span>altor incidente care afecteaz\u0103 mediul\nprincipal.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea separ\u0103rii re\u021belei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile\nnu ar trebui stocate \u00een aceea\u0219i re\u021bea cu sistemele originale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cel <\/span>pu\u021bin <\/span>o <\/span>copie <\/span>de <\/span>backup <\/span>ar <\/span>trebui <\/span>p\u0103strat\u0103\n<\/span>complet <\/span>of<\/span>fline <\/span>sau <\/span>izolat\u0103\n<\/span>fizic <\/span>pentru <\/span>a <\/span>asigura\nrecuperarea \u00een cazul unei bre\u0219e de securitate a re\u021belei sau al unui atac ransomware<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Planificarea procesului de recuperare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>R<\/span>T<\/span>O  <\/span><\/span>(c\u00e2t  <\/span><\/span>de  <\/span><\/span>repede  <\/span><\/span>trebuie  <\/span><\/span>restaurate\n <\/span><\/span>sistemele)\n <\/span><\/span>\u0219i\n <\/span><\/span>RPO\n <\/span><\/span>(c\u00e2t\n <\/span><\/span>de\n <\/span><\/span>mare\n <\/span><\/span>este\n <\/span><\/span>pierderea\nacceptabil\u0103 <\/span>de <\/span>date) <\/span>ar <\/span>trebui <\/span>definite <\/span>\u0219i <\/span>revizuite <\/span>periodic\n<\/span>pentru <\/span>a <\/span>asigura\n<\/span>o <\/span>restaurare <\/span>rapid\u0103 \u0219i eficace.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea mediilor OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Strategiile <\/span>de <\/span>backup <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>acopere <\/span>sistemele <\/span>OT<\/span>, <\/span>inclusiv <\/span>configura\u021biile <\/span>sistemelor\n<\/span>de control, datele opera\u021bionale \u0219i set\u0103rile dispozitivelor critice\npentru opera\u021biunile industr<\/span>iale.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-11.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Fiabilitatea\n\u0219i integritatea backup<\/span>-urilor trebuie\nverificate \u0219i testate periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>datele <\/span>de <\/span>backup <\/span>sunt <\/span>fiabile <\/span>\u0219i <\/span>pot <\/span>fi <\/span>restaurate <\/span>cu succes atunci c\u00e2nd este necesar,\nsprijinind continuitatea opera\u021bional\u0103 \u0219i rezilien\u021ba.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea procedurilor de recuperare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile <\/span>de <\/span>recuperare <\/span>a <\/span>backup<\/span>-urilor\n<\/span>ar <\/span>trebu<\/span>i <\/span>testate <\/span>periodic\n<\/span>pentru <\/span>a <\/span>confirma\n<\/span>c\u0103 <\/span>datele pot fi restaurate\ncu acurate\u021be \u0219i \u00een \u00eentregime.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>V<\/span>erificarea integrit\u0103\u021bii backup-urilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cenainte  <\/span> <\/span><\/span>de  <\/span> <\/span><\/span>utilizare,  <\/span> <\/span><\/span>backup<\/span>-urile  <\/span> <\/span><\/span>ar \n<\/span> <\/span><\/span>trebui \n<\/span> <\/span><\/span>verificate  <\/span> <\/span><\/span>pentru \n<\/span> <\/span><\/span>detec\u021bia  <\/span> <\/span><\/span>semnelor  <\/span> <\/span><\/span>de compromite<\/span>re, corup\u021bie sau manipulare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>erific\u0103rile <\/span>de <\/span>integritate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>se <\/span>concentreze <\/span>pe <\/span>indicatorii <\/span>de <\/span>\u00eenc\u0103lcare <\/span>ai <\/span>securit\u0103\u021bii\nsau pierderi de date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Programarea testelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate tipuril<\/span>e de surse de date ar trebui incluse \u00een testele\nde backup \u0219i re<\/span>staurare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>estarea ar trebui\ns\u0103 aib\u0103 loc cel pu\u021bin <\/span>anual sau mai\nfrecvent, pe baz\u0103 de e\u0219antion.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea <\/span>la <\/span>controalele <\/span>conexe<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acest <\/span>Control <\/span>ar <\/span>trebui <\/span>implementat <\/span>\u00een <\/span>coordonare <\/span>cu <\/span>RC.RP<\/span>-05.1 <\/span>(Planificarea <\/span>recuper\u0103rii), asigur\u00e2nd coeren\u021ba\nstrategiilor de rec<\/span>uperare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-11.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>men\u021bin\u0103\n<\/span>backup<\/span>-uri <\/span>securizate <\/span>ale <\/span>datelor <\/span>critice\n<\/span>pentru <\/span>activitate <\/span>\u00eentr<\/span>-o <\/span>loca\u021bie de <\/span>stocare <\/span>separat\u0103, <\/span>pentru\n<\/span>asigurarea <\/span>disponibilit\u0103\u021bii <\/span>datelor\n<\/span>\u00een <\/span>cazul <\/span>unei <\/span>defec\u021biuni <\/span>a <\/span>sistemului <\/span>sau al\n<\/span>pierderii datelor. <\/span>Stocarea <\/span>backup<\/span>-urilor <\/span>trebuie\n<\/span>s\u0103 <\/span>aplice <\/span>controale\n<\/span>de <\/span>securitate <\/span>echivalente <\/span>cu cele din mediul principal.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a asigura c\u0103 <\/span>organiza\u021bia <\/span>poate <\/span>recupera <\/span>\u00een <\/span>mod <\/span>fiabil <\/span>datele <\/span>sale\ncritice pentru activitate, \u00een dou\u0103 scenarii cheie:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dezastre <\/span>naturale <\/span>sau <\/span>daune <\/span>fizice <\/span>ale <\/span>sediului <\/span>principal\n<\/span>(care <\/span>necesit\u0103 <\/span>backup<\/span>-uri <\/span>la <\/span>o <\/span>loca\u021bi<\/span>e\nextern\u0103 sau \u00een cloud).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Atacuri <\/span>cibernetice <\/span>avansate, <\/span>inclusiv <\/span>ransomware <\/span>sau <\/span>amenin\u021b\u0103ri <\/span>din <\/span>interior<\/span>, <\/span>\u00een <\/span>care <\/span>atacatorii\npot \u00eencerca s\u0103 corup\u0103 sau s\u0103 \u0219tear<\/span>g\u0103\nbackup<\/span>-urile (necesit\u00e2nd backup<\/span>-uri izolate sau protejate \u00eempotriva <\/span>manipul\u0103rii).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aces<\/span>t <\/span>Contro<\/span>l <\/span>contr<\/span>i<\/span>bui<\/span>e <\/span>l<\/span>a <\/span>asigurare<\/span>a\n<\/span>faptulu<\/span>i <\/span>c<\/span>\u0103 <\/span>o <\/span>organiza\u021bi<\/span>e <\/span>poat<\/span>e <\/span>recuper<\/span>a <\/span>datel<\/span>e <\/span>sal<\/span>e <\/span>critic<\/span>e \u00ee<\/span>n <\/span>cazul \u00ee<\/span>n car<\/span>e\ncev<\/span>a n<\/span>u func\u021b<\/span>i<\/span>oneaz<\/span>\u0103\ncorect<\/span>. S<\/span>e concentreaz<\/span>\u0103 p<\/span>e p\u0103strare<\/span>a\nbacku<\/span>p-urilo<\/span>r separat<\/span>e \u0219<\/span>i l<\/span>a\nfe<\/span>l de\nsecurizat<\/span>e <\/span>c<\/span>a <\/span>datel<\/span>e <\/span>originale<\/span>,\n<\/span>cee<\/span>a <\/span>c<\/span>e <\/span>\u00ee<\/span>l <\/span>fac<\/span>e <\/span>deosebi<\/span>t <\/span>d<\/span>e <\/span>uti<\/span>l <\/span>p<\/span>e<\/span>ntr<\/span>u\norganiza\u021biil<\/span>e car<\/span>e \u00eenc<\/span>\u0103 \u00ee\u0219<\/span>i dezvolt\u0103\ncapabilit\u0103\u021bil<\/span>e <\/span>d<\/span>e <\/span>securitat<\/span>e\n<\/span>cibernetic<\/span>\u0103 <\/span>(organiza\u021bi<\/span>i <\/span>c<\/span>u <\/span>o <\/span>postur<\/span>\u0103 <\/span>d<\/span>e <\/span>securitat<\/span>e\n<\/span>ma<\/span>i <\/span>p<\/span>u<\/span>\u021bi<\/span>n <\/span>matur\u0103).<\/span><\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Strategia de backup de luat \u00een considerare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru  <\/span><\/span>\u00eendeplinirea  <\/span><\/span>acestor  <\/span><\/span>obiective,\n <\/span><\/span>or<\/span>ganiza\u021bia  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>implementeze\n <\/span><\/span>o\n <\/span><\/span>abordare\ndiversificat\u0103 \u0219i rezilient\u0103 \u00een ma<\/span>terie\nde backup, precum Regula de backup 3<\/span>-2-1:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Men\u021binerea\na trei copii ale datelor critice pentru activitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Stocarea <\/span>acestor\n<\/span>copii <\/span>pe <\/span>cel <\/span>pu\u021bin <\/span>dou\u0103 <\/span>tipuri <\/span>diferite\n<\/span>de <\/span>suporturi <\/span>de <\/span>stocare <\/span>(de <\/span>exe<\/span>mplu, disc local \u0219i cloud).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Asigurarea <\/span>c\u0103 <\/span>cel <\/span>pu\u021bin <\/span>o <\/span>copie <\/span>este <\/span>stocat\u0103\n<\/span>la <\/span>o <\/span>loca\u021bie <\/span>extern\u0103 <\/span>sau <\/span>\u00een <\/span>afara <\/span>incintei, <\/span>\u00eentr<\/span>–\no loca\u021bie fizic separat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Pentru prot<\/span>ec\u021bie \u00eempotriva amenin\u021b\u0103rilor fizice \u0219i cibernetice, or<\/span>ganiza\u021bia ar trebui s\u0103 ia \u00een considerare\nurm\u0103toarele tipuri de backup:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-uri\nla o loca\u021bie extern\u0103 sau \u00een cloud<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Aceste <\/span>backup-uri <\/span>sunt <\/span>stocate <\/span>\u00eentr<\/span>-o <\/span>loca<\/span>\u021bie <\/span>separat\u0103\n<\/span>geografic <\/span>\u0219i <\/span>con<\/span>tribuie <\/span>la <\/span>asigurarea\nrecuperabilit\u0103\u021bii \u00een cazul unor dezastre naturale sau al deterior\u0103rii fizice a\nsite<\/span>-ului principal.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-uri <\/span>imuabile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Acestea <\/span>sunt <\/span>backup-uri <\/span>care <\/span>nu <\/span>pot <\/span>fi <\/span>modificate <\/span>sau <\/span>\u0219terse <\/span>pentru <\/span>o <\/span>perioad\u0103\n<\/span>determinat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Sunt\n<\/span>deosebit <\/span>de <\/span>eficace <\/span>\u00eempotriva <\/span>ransomware<\/span>-ului <\/span>\u0219i <\/span>a <\/span>amenin\u021b\u0103rilor <\/span>din <\/span>interior <\/span>\u0219i <\/span>pot\nfi automatizate pentru re<\/span>ducerea\nefortului manual.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-uri\nof<\/span>fline sau izolate fizic<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Acestea <\/span>sunt <\/span>backup-uri <\/span>stocate\n<\/span>pe <\/span>dispozitive <\/span>complet\n<\/span>deconectate <\/span>de <\/span>la <\/span>orice <\/span>re\u021bea, inclusiv <\/span>de <\/span>la <\/span>internet. Aceast\u0103 <\/span>izolare <\/span>asigur\u0103 <\/span>c\u0103, <\/span>chiar <\/span>dac\u0103 <\/span>re\u021beaua <\/span>or<\/span>ganiza\u021biei <\/span>este compromis\u0103, backup-ul r\u0103m\u00e2ne intact.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Considera\u021bii <\/span>suplimentare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Separarea\ngeografic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Loca\u021biile <\/span>backup-urilor ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>situate <\/span>\u00een <\/span>regiuni <\/span>fizice <\/span>diferite, <\/span>pentru <\/span>reducerea\nriscului unui impact simultan din cauza unor dezastre regionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Paritatea\nde securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>T<\/span>oate <\/span>loca\u021biile <\/span>de <\/span>backup <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>implementeze <\/span>acela\u0219i\n<\/span>nivel <\/span>de <\/span>controale\n<\/span>de <\/span>securitate ca ale mediului\nprincipal (de exemplu, criptare, controlul accesului, monitorizare).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>estarea periodic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Procedurile <\/span>de <\/span>backup <\/span>\u0219i <\/span>recuperare <\/span>ar <\/span>trebui <\/span>testate\n<\/span>periodic <\/span>pentru <\/span>asigurar<\/span>ea <\/span>integrit\u0103\u021bii datelor \u0219i disponibilitatea\nopera\u021bional\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-11.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 verifice\nperiodic integritatea \u0219i capacitatea de recup<\/span>erare\na backup<\/span>-urilor, prin teste <\/span>coordonate\n<\/span>cu <\/span>toate <\/span>func\u021biile <\/span>relevante <\/span>de <\/span>continuitate <\/span>\u0219i r\u0103spuns\n<\/span>la <\/span>inci<\/span>dente. <\/span>Testarea <\/span>backup- urilor trebuie integrat\u0103 \u00een\nplanificarea mai larg\u0103 a rezilien\u021bei, inclusiv continuitatea activit\u0103\u021bii,\nrecuperarea \u00een caz de dezastru \u0219i r\u0103spunsul la incidente cibernetice.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest <\/span>Control <\/span>este <\/span>o <\/span>evolu\u021bie <\/span>a <\/span>PR.DS<\/span>-11.3 <\/span>\u0219i <\/span>asigur\u0103 <\/span>c\u0103 <\/span>sistemele de <\/span>backup <\/span>nu <\/span>sunt <\/span>doar\nimplementate, <\/span>ci <\/span>\u0219i <\/span>testate <\/span>periodic\n<\/span>\u0219i <\/span>aliniate <\/span>la <\/span>p<\/span>lanurile\n<\/span>mai <\/span>ample <\/span>de <\/span>rec<\/span>uperare\n<\/span>\u0219i <\/span>co<\/span>ntinuitate <\/span>ale\norganiza\u021biei. <\/span>Aceasta <\/span>subliniaz\u0103 <\/span>importan\u021ba <\/span>coordon\u0103rii <\/span>\u00eentre <\/span>echipe <\/span>\u0219i <\/span>a <\/span>planific\u0103rii <\/span>proactive, <\/span>aj<\/span>ut\u00e2nd organiza\u021bia s\u0103 fie preg\u0103tit\u0103 pentru recuperarea\nrapid\u0103 \u0219i eficace \u00een urma incidentelor grave.<\/span><\/p>\n\n

Pentru a asigura\neficacitatea \u0219i integrarea \u00een strategia general\u0103 de rezilien\u021b\u0103 organiza\u021bional<\/span>\u0103 a capabilit\u0103\u021bilor de backup \u0219i\nrecuperare, ar tr<\/span>ebui impleme<\/span>ntate urm\u0103toarele practici:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Coordonarea test\u0103rii backup-urilor pentru toate\nplanurile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>erificarea  <\/span><\/span>backup-urilor  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>planificat\u0103\n <\/span><\/span>\u0219i\n <\/span><\/span>executat\u0103\n <\/span><\/span>\u00een\n <\/span><\/span>coordonare\n <\/span><\/span>cu\n <\/span><\/span>echipele\nresponsabile <\/span>pentru <\/span>planurile <\/span>cheie <\/span>de <\/span>continuitate <\/span>\u0219i <\/span>r\u0103spuns <\/span>ale <\/span>or<\/span>ganiza\u021biei. <\/span>Ac<\/span>estea <\/span>includ:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>BCP-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>DRP-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Planuri\nde ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Planuri\nde continuitate a opera\u021biunilo<\/span>r\n(COOP).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Planuri\nde comunicare de criz\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Planuri\nde protec\u021bie a infrastructurilor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Planuri\nde r\u0103spuns la incidente cibernetice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea recuper\u0103rii backup-urilor \u00een testarea\nscenariilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>t<\/span>impul <\/span>exerci\u021biilor <\/span>sau <\/span>simul\u0103ril<\/span>or <\/span>de <\/span>incidente <\/span>(de <\/span>exemplu, <\/span>atacuri\n<\/span>cibernetice, <\/span>defec\u021biun<\/span>i ale sistemului <\/span>sau <\/span>dezastre <\/span>naturale), <\/span>recuperarea <\/span>backup<\/span>-urilor\n<\/span>ar <\/span>trebui <\/span>testat\u0103\n<\/span>\u00een <\/span>mod explicit. Ac<\/span>easta <\/span>garanteaz\u0103 <\/span>c\u0103 <\/span>backup-urile <\/span>nu <\/span>sunt <\/span>doar <\/span>disponibile, <\/span>ci <\/span>\u0219i <\/span>utilizabile <\/span>\u0219i aliniate la R<\/span>T<\/span>O\/RPO.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i revizuirea rezultatelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Rezultatele <\/span>verific\u0103rii <\/span>backup<\/span>-urilor <\/span>\u0219i <\/span>ale <\/span>testelor\n<\/span>de <\/span>recuperare <\/span>ar <\/span>trebui <\/span>documentate <\/span>\u0219i revizuite \u00eempreun\u0103 cu p\u0103r\u021bile <\/span>interesate re<\/span>levante\npentru identificarea lacun<\/span>elor \u0219i\n\u00eembun\u0103t\u0103\u021birea procedurilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-11.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Backup-urile sistemelor\ncritice (precum sistemele de operare, configura\u021biile \u0219i aplica\u021biile) trebuie\np\u0103strate <\/span>separat <\/span>de <\/span>backup-urile <\/span>informa\u021biilor <\/span>critice <\/span>(precum <\/span>datele\n<\/span>activit\u0103\u021bii, <\/span>documentele <\/span>\u0219i <\/span>bazele\nde date) pentru permiterea unei recuper\u0103ri mai rapide \u0219i mai fiabile.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a sprijini o recuperare mai rapid\u0103 \u0219i mai fiabil\u0103 prin\nsepararea backup-urilor <\/span>sistemelor\ncritice <\/span>(de <\/span>exemplu, <\/span>sisteme <\/span>de <\/span>operare, <\/span>configura\u021bii, <\/span>aplica\u021bii) <\/span>de <\/span>backup<\/span>–\nurile informa\u021biilor critice (de exemplu, datele activit\u0103\u021bii, documente, baze de\ndate).<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103<\/span>toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Separarea domeniilor de <\/span>aplicare ale backup<\/span>-urilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile <\/span>sistemului <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>sistemele\n<\/span>de <\/span>operare, <\/span>configura\u021biile, <\/span>software<\/span>-ul instalat \u0219i\nset\u0103rile la <\/span>nivel de sistem.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile <\/span>informa\u021biilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>date <\/span>critice <\/span>pentru <\/span>activitate, <\/span>precum <\/span>baze <\/span>de date, documente \u0219i date ale aplica\u021biilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea metodelor de backup personalizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile <\/span>sistemului <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>utilizeze <\/span>imagini\n<\/span>complete <\/span>sau <\/span>instantanee <\/span>pentru <\/span>a captura\nstarea integral\u0103 a sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile <\/span>informa\u021biilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>utilizeze <\/span>metode\n<\/span>incrementale <\/span>sau <\/span>diferen\u021biale <\/span>pentru <\/span>a captura \u00een\nmod eficient modific\u0103rile datelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Criptarea datelor sensibile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>At\u00e2t <\/span>backup-urile <\/span>sistemului, <\/span>c\u00e2t <\/span>\u0219i <\/span>cele <\/span>ale <\/span>informa\u021biilor <\/span>ar <\/span>trebui <\/span>crip<\/span>tate <\/span>\u00een <\/span>timpul <\/span>sto<\/span>c\u0103rii <\/span>\u0219i transmiterii, \u00een special atunci c\u00e2nd\ncon\u021bin date sensibile sau reglementate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la obiectivele de recuperare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Separarea <\/span>backup-urilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>reflecte <\/span>diferite\n<\/span>R<\/span>T<\/span>O <\/span>\u0219i <\/span>RPO. <\/span>De <\/span>exemplu,\n<\/span>recuperarea sistemului ar putea necesita o restaurar<\/span>e mai rapid\u0103 dec\u00e2t datele activit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i automatizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Domeniile\nde aplicare \u0219i procedurile de backup ar <\/span>trebui\ndocumentate \u00een mod clar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesele <\/span>de <\/span>backup\n<\/span>ar <\/span>trebui <\/span>automatizate, <\/span>acolo <\/span>unde <\/span>este <\/span>fezabil, <\/span>pentru\n<\/span>reducerea <\/span>erorilor umane \u0219i asigurarea\nconsecven\u021bei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

Considera\u021bii\nspecifice <\/span>OT<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen mediile OT, separarea\nbackup<\/span>-urilor sistemului \u0219i ale\ndatelor contribuie la restabilirea rapid\u0103 a sistemelor <\/span>de <\/span>control, <\/span>f\u0103r\u0103 <\/span>a <\/span>fi necesar\u0103 <\/span>recuperarea <\/span>seturilor <\/span>mari <\/span>de <\/span>date. Aceasta <\/span>sus\u021bine continuitat<\/span>ea\nopera\u021bional\u0103 \u0219i reduce timpul de nefunc\u021bionare \u00een procesele industriale\ncritice.<\/span><\/p>\n\n

Rela\u021bia cu\nPR.DS-11.3 \u0219i PR.DS-11.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.DS-11.5 <\/span>este <\/span>o <\/span>evolu\u021bie\n<\/span>– <\/span>nu <\/span>o <\/span>repetare <\/span>– <\/span>a <\/span>PR.DS-11.3 <\/span>\u0219i <\/span>PR.DS-11.4. <\/span>\u00cen <\/span>timp <\/span>ce <\/span>controalele\nanterioare <\/span>se <\/span>concentrea<\/span>z\u0103 <\/span>pe <\/span>locul <\/span>\u0219i <\/span>m<\/span>odul <\/span>\u00een <\/span>care <\/span>sunt <\/span>stocate <\/span>\u0219i <\/span>verifi<\/span>cate <\/span>backup<\/span>-urile, <\/span>PR.DS-<\/span><\/p>\n\n

11.5\n<\/span>se <\/span>concentreaz\u0103 <\/span>pe <\/span>ceea <\/span>ce <\/span>este <\/span>copiat\n<\/span>\u0219i <\/span>modul <\/span>\u00een <\/span>care <\/span>este <\/span>separat <\/span>logic\n<\/span>pentru <\/span>a <\/span>optimiza recuperarea:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>PR.DS-1<\/span>1.3\nasigur\u0103 c\u0103 backup-urile sunt securizate \u0219i stocate separat;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>PR.DS-1<\/span>1.4\nasigur\u0103 testarea backup-urilor \u0219i integrarea acestora \u00een planificarea\nrecuper\u0103rii;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>PR.DS-1<\/span>1.5 <\/span>asigur\u0103\n<\/span>separarea <\/span>func\u021bio<\/span>nal\u0103 <\/span>\u00eentre <\/span>backup<\/span>-urile <\/span>sistemului <\/span>\u0219i <\/span>cele <\/span>ale <\/span>datelor <\/span>pentru a permite o recuperare mai rapid\u0103\n\u0219i mai precis\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[PR.PS]\nSECURITATEA PLATFORMEI<\/span><\/b><\/span><\/p>\n\n

 <\/p>\n\n

Hardware-ul, software-ul\n(de exemplu, firmware, sisteme de operare, aplica\u021bii) \u0219i serviciile\nplatformelor fizice \u0219i virtuale sunt gestionate \u00een conformitate cu strategia de\nmanagement al riscului a organiza\u021biei pentru protejarea confiden\u021bialit\u0103\u021bii,\nintegrit\u0103\u021bii \u0219i disponibilit\u0103\u021bii.<\/span><\/p>\n\n

PR.PS-01<\/span><\/b><\/span><\/p>\n\n

 <\/p>\n\n

Practicile de management al configura\u021biei sunt\nstabilite \u0219i aplicate.<\/span><\/p>\n\n

 <\/p>\n\n

PR.PS-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>dezvolte,\n<\/span>documenteze <\/span>\u0219i <\/span>men\u021bin\u0103\n<\/span>o <\/span>configura\u021bie <\/span>de <\/span>baz\u0103 <\/span>pentru <\/span>sistemele <\/span>sale critice pentru activitate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/p>\n\n

Acest Control asigur\u0103 c\u0103\ntoate sistemele critice pentru activitate func\u021bioneaz\u0103 \u00eentr<\/span>-o stare cunoscut\u0103, securizat\u0103 \u0219i\naprobat\u0103. O configura\u021bie de baz\u0103 define\u0219te setarea stand<\/span>ard pentru aceste sisteme, contribuind <\/span>la <\/span>detec\u021bia <\/span>modific\u0103rilor <\/span>neautorizate, <\/span>punerea <\/span>\u00een <\/span>aplicare <\/span>a <\/span>politicilor\nde <\/span>securitate <\/span>\u0219i sus\u021binerea opera\u021biunilor consecvente.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea sintagmei critic pentru activitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>critice <\/span>pentru\n<\/span>activitate <\/span>ar <\/span>putea\n<\/span>include <\/span>componente <\/span>IT<\/span>, <\/span>OT <\/span>\u0219i, <\/span>poten\u021bial, <\/span>Io<\/span>T <\/span>– <\/span>dac\u0103\nacestea sus\u021bin func\u021bii esen\u021biale ale or<\/span>ganiza\u021biei:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sistemele\nIT <\/span>sunt de obic<\/span>ei gestionate intern.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Sistemele\nOT <\/span>ar putea include ICS.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Sistemele <\/span>IoT <\/span>(de <\/span>exemplu,\n<\/span>senzori, <\/span>dispozitive <\/span>in<\/span>teligente) <\/span>pot <\/span>fi <\/span>critice\n<\/span>pentru <\/span>activitate dac\u0103\ndefectarea lor pertu<\/span>rb\u0103 opera\u021biunile\nsau introduce riscuri de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea \u0219i men\u021binerea configura\u021biilor de baz\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru\nfiecare sistem critic pentru activitate, linia de baz\u0103 ar trebui s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Componentele\nsistemului (de exemplu, software \u0219i hardware aprobat).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>V<\/span>ersiunile sistemului de operare \u0219i ale\naplica\u021biilor<\/span>, inclusiv nivelurile de\npatch<\/span>-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Set\u0103ri\n\u0219i parametri de configurare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>T<\/span>opologia re<\/span>\u021belei, care arat\u0103 mod<\/span>ul\n\u00een care sunt conectate componentele, inclusiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Conexiuni\nexterne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Servere\ncare g\u0103zduiesc date sau func\u021bii sensibile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Servicii\nDNS \u0219i de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Amplasarea\nlogic\u0103 a componentelor \u00een cadrul arhitecturii sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea principiilor de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Liniile <\/span>de <\/span>baz\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>pun\u0103 <\/span>\u00een <\/span>aplicare\n<\/span>pri<\/span>ncipiul <\/span>func\u021bionalit\u0103\u021bii <\/span>minime <\/span>– <\/span>ar <\/span>trebui\nactivate <\/span>numai <\/span>func\u021biile \u0219i <\/span>serviciile <\/span>necesare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Set\u0103rile <\/span>implicite <\/span>ar <\/span>trebui <\/span>revizuite <\/span>\u0219i <\/span>ajustate <\/span>pentru\n<\/span>reducerea <\/span>riscurilor <\/span>de <\/span>securitate <\/span>\u00een timpul instal\u0103rii sau actualiz\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i actualizarea liniei de baz\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea\ncontinu\u0103 a sistemelor pentr<\/span>u detec\u021bia\nabaterilor de la linia de baz\u0103 aprobat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualizarea <\/span>liniilor <\/span>de <\/span>baz\u0103 <\/span>\u00een <\/span>urma <\/span>aplic\u0103rii\n<\/span>de <\/span>patch<\/span>-uri, <\/span>a <\/span>actualiz\u0103rilor <\/span>sau <\/span>a <\/span>reconfigur\u0103rii sistemelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sisteme gestionate \u00een cloud \u0219i de furnizori<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>sistemele <\/span>gestionate <\/span>de <\/span>p\u0103r\u021bi <\/span>ter\u021be <\/span>(de <\/span>exemplu,\n<\/span>servicii <\/span>cloud), <\/span>or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 se <\/span>asigure <\/span>c\u0103 <\/span>a\u0219tept\u0103rile <\/span>privind\n<\/span>linia <\/span>de <\/span>baz\u0103 <\/span>sunt <\/span>definite\n<\/span>cont<\/span>ractual \u0219i <\/span>c\u0103 <\/span>furnizorii <\/span>ofer\u0103 vizibilitate asupra config<\/span>ura\u021biei \u0219i a managementului modific\u0103rilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>configureze <\/span>sistemele <\/span>sale <\/span>critice <\/span>pentru <\/span>activitate astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>func\u021bioneze doar cu func\u021biile esen\u021biale\nnecesare sc<\/span>opului lor. Aceasta\ninclude revizuirea \u0219i actualizarea configura\u021biilor de baz\u0103 pentru a dezactiva\norice capabilit\u0103\u021bi neesen\u021biale.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Con<\/span>trol este de a reduce riscurile de\nsecuritate \u0219i complexita<\/span>tea\nsistemului, asigur\u00e2nd <\/span>c\u0103 <\/span>sistemele\n<\/span>critice <\/span>pentru activitate <\/span>sunt <\/span>configurate <\/span>s\u0103 <\/span>execute <\/span>numai <\/span>func\u021biile <\/span>necesare pentru scopul pentru care au fost\nconcepute.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aplicarea <\/span>principiului <\/span>func\u021bional<\/span>it\u0103\u021bii <\/span>minime <\/span>prin <\/span>dezactivarea <\/span>caracteristicilor<\/span>, <\/span>serviciilor <\/span>\u0219i componentelor neesen\u021biale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Revizuirea  <\/span><\/span>\u0219i  <\/span><\/span>actualizarea  <\/span><\/span>periodic\u0103  <\/span><\/span>a  <\/span><\/span>configura\u021biilor\n <\/span><\/span>de\n <\/span><\/span>baz\u0103\n <\/span><\/span>pentru\n <\/span><\/span>reflectarea\n <\/span><\/span>nevoilor\nopera\u021bionale <\/span>\u0219i amenin\u021b\u0103rilor \u00een\ncontinu\u0103 evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea \u0219i limitar<\/span>ea\nurm\u0103toarelor elemente la ceea ce este strict necesar:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software instalat; <\/span>o <\/span><\/span>Servicii activate; <\/span>o <\/span><\/span>Porturi deschise;<\/span><\/p>\n\n

o <\/span><\/span>Protocoale\npermise;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Caracteristici <\/span>ale <\/span>sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Alinierea <\/span>configura\u021biilor <\/span>la <\/span>polit<\/span>icile <\/span>de <\/span>securitate <\/span>pentru <\/span>minimizarea <\/span>expunerii <\/span>la <\/span>vu<\/span>lner<\/span>abilit\u0103\u021bi\n\u0219i \u00eembun\u0103t\u0103\u021birea performan\u021bei sistemului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>identifice <\/span>\u0219i <\/span>s\u0103 <\/span>dezactiveze <\/span>func\u021biile, <\/span>porturile, <\/span>protocoalele <\/span>\u0219i <\/span>serviciile\nspecifice din cadrul sistemelor sale critice care nu sunt necesare pentru\nopera\u021biunile org<\/span>aniza\u021biei. GHID DE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nreduce <\/span>suprafa\u021ba <\/span>de <\/span>ata<\/span>c <\/span>a <\/span>sistemelor <\/span>critice <\/span>pri<\/span>n <\/span>dezactivarea\nfunc\u021biilor, porturilor, protocoalelor \u0219i serviciilor care nu sunt esen\u021biale\npentru opera\u021biunile organiza\u021biei.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Identificarea <\/span>caracteristicilor <\/span>sistemului <\/span>care <\/span>nu <\/span>sunt <\/span>necesare <\/span>pe <\/span>baza <\/span>rolului\n<\/span>sistemului <\/span>\u0219i <\/span>a riscurilor asociate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dezactivarea <\/span>elementelor <\/span>inutile\n<\/span>pentru <\/span>limitarea <\/span>poten\u021bi<\/span>alelor <\/span>punc<\/span>te <\/span>de <\/span>intrare <\/span>\u0219i <\/span>reducerea\nmi\u0219c\u0103rii laterale \u00een cadrul re\u021belei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Evaluarea <\/span>\u0219i <\/span>actualizarea <\/span>periodic\u0103 <\/span>a <\/span>configura\u021biilor <\/span>pentru <\/span>reflectarea <\/span>nevoilor\n<\/span>opera\u021bionale <\/span>\u0219i amenin\u021b\u0103rilor\n\u00een continu\u0103 evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Elementele care trebuie luate \u00een <\/span>considerare pe<\/span>ntru dezactivare includ:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Bluetooth;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>FTP;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Re\u021bele\npeer<\/span>-to-peer;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Alte\nservicii neutilizate sau vechi.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 implementeze <\/span>m\u0103suri de protec\u021bie tehnice pentru punerea\n\u00een aplicare a unei politici <\/span>de <\/span>refuz <\/span>total <\/span>\u0219i <\/span>permitere <\/span>prin <\/span>excep\u021bie, <\/span>astf<\/span>el <\/span>\u00eenc\u00e2t\n<\/span>s\u0103 <\/span>fie <\/span>executate <\/span>doar <\/span>programele <\/span>software autorizate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>nu<\/span>mai <\/span>software<\/span>-ul <\/span>autorizat <\/span>\u00een <\/span>mod <\/span>explicit\n<\/span>este <\/span>permis s\u0103 <\/span>ruleze,\n<\/span>reduc\u00e2nd <\/span>riscul <\/span>ca <\/span>programe <\/span>neautorizate <\/span>sa<\/span>u <\/span>cu <\/span>scop <\/span>nelegitim\n<\/span>s\u0103 <\/span>afecteze <\/span>sistemele\n<\/span>criti<\/span>ce. \u00cen vederea\nrealiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Implementarea <\/span>listei <\/span>albe <\/span>de <\/span>aplica\u021bii\n<\/span>pentru <\/span>permiterea <\/span>execut\u0103rii\n<\/span>do<\/span>ar <\/span>a <\/span>programelor <\/span>software aprobate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizarea <\/span>poli<\/span>ticilor\n<\/span>de <\/span>grup <\/span>pentru <\/span>punerea <\/span>\u00een <\/span>aplicare <\/span>a <\/span>re<\/span>gulilor\n<\/span>de <\/span>control <\/span>al <\/span>aplica\u021biilor <\/span>\u00een toate\n<\/span>sistemele.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aplicarea  <\/span><\/span>P<\/span>oliticilor\n <\/span><\/span>de\n <\/span><\/span>restric\u021bie\n <\/span><\/span>software\n <\/span><\/span>(SRP)\n <\/span><\/span>sau\n <\/span><\/span>mecanisme\n <\/span><\/span>similare\n <\/span><\/span>pentru\n <\/span><\/span>blocarea\nsoftware-ului neautorizat pe baza c\u0103ii de acces la <\/span>fi\u0219ier<\/span>, a has<\/span>h<\/span>-ului\nsau a semn\u0103turii digitale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Punerea <\/span>\u00een <\/span>aplicare\n<\/span>a <\/span>RBAC <\/span>pentru <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>numai <\/span>utilizatorii <\/span>autoriza\u021bi <\/span>pot <\/span>rula <\/span>anumite\naplica\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Configurare<\/span>a <\/span>Java <\/span>Security <\/span>Manager\n<\/span>pentru <\/span>restric\u021bionarea <\/span>claselor\n<\/span>\u0219i <\/span>metodelor <\/span>care <\/span>pot <\/span>fi executate \u00een medii bazate pe Java.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizarea <\/span>instrumentelor <\/span>de <\/span>management <\/span>al <\/span>configura\u021biei <\/span>pentru <\/span>men\u021binerea <\/span>punerii\n<\/span>\u00een <\/span>aplicare consecvente a\nsoftware-ului autoriza<\/span>t \u00een toate\nsistemele.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-01.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Modific\u0103rile <\/span>neautorizate <\/span>ale <\/span>configura\u021biei <\/span>sistemelor <\/span>organiza\u021biei <\/span>trebuie\n<\/span>moni<\/span>torizate <\/span>\u0219i <\/span>abordate <\/span>cu m\u0103suri de atenuare adecvate.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a detecta\n<\/span>\u0219i <\/span>r\u0103spunde <\/span>la <\/span>modific\u0103rile <\/span>neautorizate ale <\/span>configura\u021biei care ar putea compromite <\/span>integri<\/span>tatea sau\ndisponibilitatea <\/span>sistemului.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea modific\u0103rilor de configurare \u00een\nconformitate cu politicile \u0219i procedurile definite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Detec\u021bia \u0219i jurnalizarea modific\u0103rilor neautorizate\nale set\u0103ri<\/span>lor sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alertarea personalului desemnat atunci c\u00e2nd apar\nmodific\u0103ri neautorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Restabilirea prompt\u0103 a configura\u021biilor aprobate pentru\nmen\u021binerea stabilit\u0103\u021bii opera\u021bionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cen cazuri critice, oprirea <\/span>proceselor sistemului afectat pentru prevenire<\/span>a impactului suplimentar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Consultarea <\/span>recomand\u0103rilor <\/span>din <\/span>Ghidul\n<\/span>tehnic <\/span>de <\/span>implementare <\/span>a <\/span>NIS <\/span>2 <\/span>elaborat <\/span>de <\/span>c\u0103tre <\/span>ENISA, care recomand\u0103 monitorizarea\ncontinu\u0103 \u0219i atenuarea prompt\u0103 a modific\u0103rilor neautorizate pentru p\u0103strarea rezilien\u021bei\n\u0219i conformit\u0103\u021bii si<\/span>stemului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Software-ul este men\u021binut, \u00eenlocuit \u0219i eliminat \u00een\nfunc\u021bie de ris<\/span>c.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>pun\u0103 <\/span>\u00een <\/span>aplicare <\/span>restric\u021bii <\/span>privind <\/span>utilizarea <\/span>\u0219i <\/span>instalarea <\/span>softw<\/span>are<\/span>-ului <\/span>\u0219i <\/span>s\u0103 <\/span>se\nasigure c\u0103 software-ul este men\u021binut, \u00eenlocuit sau eliminat \u00een func\u021bie de\nriscul s\u0103u aso<\/span>ciat.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a reduce riscurile opera\u021bionale \u0219i de securitate prin controlu<\/span>l software-ului utilizat, asigurarea\nmen\u021binerii corespunz\u0103toare a acestuia \u0219i <\/span>eliminarea\nsa atunci c\u00e2nd nu mai este necesar sau nu mai este suportat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Permiterea <\/span>doar <\/span>a <\/span>software<\/span>-ului <\/span>aprobat <\/span>\u0219i <\/span>restric\u021bionarea <\/span>accesului <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>rolurile <\/span>\u0219i responsabilit\u0103\u021bile utilizatorilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cenlocuirea <\/span>software-ului <\/span>nesuportat <\/span>sau <\/span>ajuns <\/span>la <\/span>E<\/span>OL <\/span>pentru <\/span>evitarea\n<\/span>vulnerabilit\u0103\u021bilor <\/span>f\u0103r\u0103 <\/span>patch<\/span>–\nuri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dezinstalarea <\/span>software-ului <\/span>neutilizat <\/span>sau <\/span>inutil, <\/span>inclusiv\n<\/span>utilitarele <\/span>de <\/span>sistem <\/span>de <\/span>operare\n<\/span>\u00eenvechite, pentru reduc<\/span>erea s<\/span>uprafe\u021bei de atac.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea patch<\/span>-urilor\n\u00een func\u021bie de risc:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>ulnerabilit\u0103\u021bilor\ncritice ar trebui s\u0103 le fie aplicate patch<\/span>-uri\n\u00een c\u00e2teva ore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualiz\u0103rile <\/span>de <\/span>rutin\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>un <\/span>program <\/span>stabilit <\/span>(de <\/span>exemplu, <\/span>s\u0103pt\u0103m\u00e2nal\n<\/span>sau lunar).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cen <\/span>mediile <\/span>containerizate, <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>doar <\/span>imagini <\/span>de <\/span>\u00eencrede<\/span>re <\/span>\u0219i <\/span>actualizate; <\/span>containerele \u00eenvechite ar trebui \u00eenlocuite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Eliminarea <\/span>sau <\/span>dezactivarea <\/span>software-ului <\/span>\u0219i <\/span>serviciilor <\/span>care <\/span>prezint\u0103 <\/span>un <\/span>risc <\/span>inacceptabil, <\/span>precum<\/span><\/p>\n\n

 <\/span><\/p>\n\n

FTP <\/span>sau <\/span>instrumentele <\/span>peer<\/span>-to-peer<\/span>, <\/span>cu <\/span>excep\u021bia\n<\/span>cazului <\/span>\u00een <\/span>care <\/span>sunt <\/span>explicit\n<\/span>necesare <\/span>\u0219i <\/span>securizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cen <\/span>mediile <\/span>ICS\/OT<\/span>, <\/span>asigurarea <\/span>aprob\u0103rii <\/span>prealabile <\/span>\u0219i <\/span>a <\/span>planific\u0103rii <\/span>program\u0103rii <\/span>PLC; <\/span>evitarea modific\u0103rilor ad-hoc pentru\nprotejarea siguran\u021bei opera\u021bionale<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea unui inventar al s<\/span>o<\/span>ftware-ului cu\nversiunea \u0219i starea suportului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Definirea <\/span>procedurilor <\/span>pentru\n<\/span>aprobarea, <\/span>aplicarea <\/span>de <\/span>patch<\/span>-uri, <\/span>\u00eenlocuirea <\/span>\u0219i <\/span>eliminarea <\/span>software<\/span>–\nului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Hardware-ul este men\u021binut, \u00eenlocuit \u0219i <\/span>eliminat \u00een func\u021bie de risc.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Hardware-ul <\/span>utilizat <\/span>\u00een <\/span>mediile\n<\/span>critice <\/span>pentru <\/span>activitate <\/span>trebuie <\/span>men\u021binut, <\/span>\u00eenlocuit\n<\/span>sau <\/span>eliminat <\/span>\u00een func\u021bie de riscurile sale de securitate\n\u0219i opera\u021bionale asociate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 hardware<\/span>-ul utilizat \u00een\nmedii critice pentru activitate r\u0103m\u00e2ne securizat, fiabil \u0219i adecvat scopului, gestion\u00e2ndu<\/span>-l \u00een func\u021bie de riscurile opera\u021bionale \u0219i\nde securitate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Evaluarea periodic\u0103 a hardware-ului\npentru a stabili dac\u0103 suport\u0103 func\u021bi<\/span>onalit\u0103\u021bile\nde securitate necesare <\/span>(de <\/span>exemplu,\n<\/span>criptare, <\/span>pornire <\/span>securizat\u0103, <\/span>actualiz\u0103ri <\/span>de <\/span>firmwa<\/span>re); <\/span>\u00eenlocuirea <\/span>hardware<\/span>– ului care\nnu poate satisface aceste cerin\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Retragerea treptat\u0103 a hardware<\/span>-ului EOL <\/span>sau care nu\nmai este suportat, <\/span>\u00eentr<\/span>-un mod controlat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea \u0219i men\u021binerea <\/span>unui plan privind ciclul de <\/span>via\u021b\u0103\nal hardware<\/span>-ului, care s\u0103 includ\u0103:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Urm\u0103rirea\ninventarului;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ermene EO<\/span>L;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Programele\nde \u00eenlocuire;<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Proceduri\nde casare securizat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Efectuarea  <\/span>mentenan\u021bei \n<\/span>preventive  <\/span>\u0219i  <\/span>a  <\/span>\u00eenlocuirilor  <\/span>la \n<\/span>timp  <\/span>pentru  <\/span>evitarea \n<\/span>defec\u021biunilor nea\u0219teptate care ar putea afecta opera<\/span>\u021biunile sau securitatea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Asigurarea <\/span>faptului <\/span>c\u0103 <\/span>hardware<\/span>-ul <\/span>poate\n<\/span>sus\u021bine <\/span>rularea <\/span>unui <\/span>software <\/span>securizat <\/span>\u0219i <\/span>actualizat,\nprecum \u0219i abordarea oric<\/span>\u0103ror limit\u0103ri\ncare \u00eempiedic\u0103 acest lucru.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cenregistr\u0103rile din jurnal sunt generate \u0219i puse la\ndispozi\u021bie pentru monitorizarea continu\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Jurnalele trebuie men\u021binute, documentate \u0219i\nmonitorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>jurnalele <\/span>sunt <\/span>men\u021binute, <\/span>documentate <\/span>\u0219i <\/span>monitoriz<\/span>at<\/span>e\n\u00een mod consecvent pentru sprijinirea vizibilit\u0103\u021bii, r\u0103spunderii \u0219i detec\u021biei\ntimpurii a anomaliilor sau amenin\u021b\u0103rilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiec<\/span>tiv<\/span>,\nar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Activarea jurnaliz\u0103rii \u00een toate sistemele<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate  <\/span><\/span>sistemele  <\/span><\/span>de  <\/span><\/span>operare,\n <\/span><\/span>aplica\u021biile,\n <\/span><\/span>serviciile\n <\/span><\/span>(inclusiv\n <\/span><\/span>cele\n <\/span><\/span>bazate\n <\/span><\/span>pe\n <\/span><\/span>cloud)\n <\/span><\/span>\u0219i\ninstrumentele de securit<\/span>ate (de exemplu,\nfirewall<\/span>-uri, antivirus) ar <\/span>trebui configurate pentru generarea\n\u00eenregistr\u0103rilor din jurnal.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea unei variet\u0103\u021bi de tipuri de jurnale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnalele <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103,\n<\/span>dup\u0103 <\/span>caz: <\/span>jurnale <\/span>de <\/span>audit, <\/span>jurnale <\/span>de <\/span>evenimente, <\/span>jurnale\n<\/span>de aplica\u021bii, jurnale de securitate, jurnale de sistem <\/span>\u0219i <\/span>jurnale\nde mentenan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea datelor din jurnale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnalele <\/span>ar <\/span>trebui <\/span>protejate <\/span>\u00eempotriva <\/span>accesului <\/span>neautorizat <\/span>pri<\/span>n <\/span>criptare\n<\/span>\u0219i <\/span>controale <\/span>de <\/span>acces.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Realizarea backup<\/span>-urilor\njurnalelor \u0219i p\u0103strarea acestora<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Realizarea <\/span>periodic\u0103 <\/span>a <\/span>backup<\/span>-urilor\n<\/span>jurnalelor <\/span>\u0219i <\/span>p\u0103strarea <\/span>pentru <\/span>o <\/span>perioad\u0103\n<\/span>predefinit\u0103, stabilit\u0103 <\/span>\u00een <\/span>func\u021bie\n<\/span>de <\/span>necesit\u0103\u021bile <\/span>opera\u021bionale <\/span>ale <\/span>or<\/span>ganiza\u021biei <\/span>sau <\/span>de <\/span>cerin\u021bele\n<\/span>de <\/span>reglementare aplicabile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea jurnalelor pentru anomalii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnalele <\/span>ar <\/span>trebui <\/span>revizuite <\/span>pentru <\/span>detec\u021bia <\/span>tiparelor \n<\/span>sau <\/span>comportamentelor <\/span>neobi\u0219nuite, precum <\/span>detec\u021bii <\/span>repetate <\/span>de <\/span>malware <\/span>sau <\/span>acces\nexcesiv <\/span>la <\/span>site<\/span>-uri <\/span>care <\/span>nu <\/span>sunt <\/span>legate <\/span>de activitatea profesional\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea perioadelor de p\u0103strare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Perioadele <\/span>de <\/span>p\u0103strare\n<\/span>a <\/span>jurnalelor <\/span>ar <\/span>trebui <\/span>definite\n<\/span>\u00een <\/span>mod <\/span>clar<\/span>. <\/span>Luar<\/span>ea <\/span>\u00een <\/span>considerare <\/span>a cerin\u021belor specifice sectorului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea monitoriz\u0103rii \u0219i a r\u0103spunderii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea  <\/span>ar \n<\/span>trebui  <\/span>s\u0103  <\/span>fie <\/span>implementat\u0103  <\/span>pentru \n<\/span>a  <\/span>oferi  <\/span>vizibilitate \n<\/span>asupra  <\/span>activit\u0103\u021bii sistemului \u0219i\npentru sprijinirea audit\u0103rii eficace \u0219i <\/span>a\nr\u0103spunsului l<\/span>a incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea sistemelor OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Practicile <\/span>de <\/span>jurnalizare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>extinse\n<\/span>la <\/span>mediile <\/span>OT<\/span>, <\/span>inclusiv\n<\/span>la <\/span>ICS, <\/span>unde <\/span>jurnalele pot\najuta la detec\u021bia anomaliilor opera\u021bionale sau a \u00eencerc\u0103rilor de acces\nneautorizat.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-04.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie s\u0103 <\/span>se <\/span>asigure <\/span>c\u0103 <\/span>\u00eenregistr\u0103rile <\/span>din <\/span>jurnale <\/span>con\u021bin <\/span>o <\/span>surs\u0103 <\/span>de <\/span>timp <\/span>de <\/span>referin\u021b\u0103\n<\/span>sau <\/span>o marc\u0103 <\/span>temporal\u0103\n<\/span>intern\u0103 <\/span>a <\/span>ceasului,\n<\/span>care <\/span>este <\/span>comparat\u0103\n<\/span>\u0219i <\/span>sincronizat\u0103 <\/span>cu <\/span>o <\/span>surs\u0103 <\/span>de <\/span>timp <\/span>de <\/span>referin\u021b\u0103<\/span>.\nGHID DE IMPLEMENTARE<\/b><\/span><\/p>\n\n

Obiectivul acestui Con<\/span>trol este de a asigur<\/span>a c\u0103 \u00eenregistr\u0103rile din jurnale ale tuturor\nsistemelor utilizeaz\u0103 <\/span>o <\/span>referin\u021b\u0103 <\/span>temporal\u0103 <\/span>con<\/span>sistent\u0103\n<\/span>\u0219i <\/span>fi<\/span>abil<\/span>\u0103, <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>evenimentele <\/span>s\u0103 <\/span>poat\u0103 <\/span>fi <\/span>urm\u0103rite <\/span>\u0219i corelate cu precizie.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare u<\/span>rm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizarea <\/span>unei <\/span>referin\u021be\n<\/span>de <\/span>timp <\/span>fiabile, <\/span>precum <\/span>un <\/span>ceas <\/span>GPS, <\/span>un <\/span>server <\/span>de <\/span>timp <\/span>intern <\/span>sau <\/span>alt\u0103\nsurs\u0103 de \u00eencredere pentru <\/span>sincronizarea\nceasurilor sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Configurare<\/span>a <\/span>sistemelor <\/span>pentru <\/span>actualizarea <\/span>ceasurilor <\/span>periodic, <\/span>pentru <\/span>evitarea\n<\/span>dev<\/span>ia\u021biilor <\/span>de timp.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Configurare<\/span>a\nmai multor surse de timp pentru <\/span>asigurarea\nredundan\u021bei \u0219i preciziei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea <\/span>st\u0103rii <\/span>sincroniz\u0103rii <\/span>\u0219i <\/span>declan\u0219area <\/span>alertelor\n<\/span>dac\u0103 <\/span>sistemele <\/span>nu <\/span>mai <\/span>sunt <\/span>sincronizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Documentarea procedurilor de sincronizare a <\/span>timpului, inclusiv set\u0103rile serverului,\nintervalele de actualizare \u0219i procesele de monitoriza<\/span>re.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-04.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Datele de audit din sistemele critice ale organiza\u021biei\ntrebuie transferate \u00eentr<\/span>-un sistem\nalternativ.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Cont<\/span>rol este de a proteja integritatea\n\u00eenregistr\u0103rilor de audit pri<\/span>n\ntransferarea acestora <\/span>din <\/span>sistemele\n<\/span>critice \u00eentr<\/span>-o loca\u021bie <\/span>separat\u0103\n<\/span>\u0219i <\/span>securizat\u0103, <\/span>unde <\/span>nu <\/span>pot <\/span>fi <\/span>modificate <\/span>sau falsificate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een consid<\/span>erare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>ransferul <\/span>datelor <\/span>de <\/span>audit <\/span>\u00eentr<\/span>-un <\/span>sistem <\/span>separat, <\/span>unde <\/span>\u00eenregistr\u0103rile <\/span>nu <\/span>pot <\/span>fi <\/span>modificate <\/span>de utilizatori sau servicii din sistemul\noriginal.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Asigurarea <\/span>faptului <\/span>c\u0103 <\/span>sistemul <\/span>de <\/span>destina\u021bie <\/span>p\u0103streaz\u0103\n<\/span>\u00eenregistr\u0103rile <\/span>de <\/span>audit <\/span>nemodificate <\/span>odat\u0103 stocate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Monitorizarea <\/span>impactului <\/span>transferurilor <\/span>de <\/span>jurnale <\/span>pentru\n<\/span>evitarea <\/span>problemelor <\/span>de <\/span>performan\u021b\u0103 <\/span>pe sistemele surs\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Implementarea <\/span>unor <\/span>m\u0103suri <\/span>care <\/span>prot<\/span>ejeaz\u0103 <\/span>datele <\/span>f\u0103r\u0103 <\/span>\u00eencetinirea <\/span>sau <\/span>perturbarea <\/span>func\u021bion\u0103rii sistemului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-04.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 se\nasigure c\u0103 e\u0219ec<\/span>urile de procesare a\nauditului din sistemele organiza\u021biei genereaz\u0103 alerte \u0219i declan\u0219eaz\u0103 r\u0103spunsuri\ndefinite.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>ori<\/span>ce <\/span>defec\u021biune <\/span>\u00een <\/span>jurnalizarea <\/span>auditului<\/span>, <\/span>precum <\/span>erori\n\u00een colectarea, procesarea sau stocarea jurnalelor, declan\u0219eaz\u0103 alerte \u0219i\nr\u0103spunsuri predefinite pentru men\u021binerea integrit\u0103\u021bii \u0219i trasabilit\u0103\u021bii\nsistemului.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>E\u0219ecurile <\/span>de <\/span>audit <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103\n<\/span>probleme <\/span>de <\/span>software\n<\/span>sau <\/span>hardware, <\/span>mecanisme\n<\/span>de jurnalizare defecte sau stocare complet\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Alertele  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>fie  <\/span><\/span>generate\n <\/span><\/span>automat\n <\/span><\/span>atunci\n <\/span><\/span>c\u00e2nd\n <\/span><\/span>apar\n <\/span><\/span>astfel\n <\/span><\/span>de\n <\/span><\/span>e\u0219ecuri,\n <\/span><\/span>ia<\/span>r  <\/span><\/span>ac\u021biunile predefinite ar trebui\ndeclan\u0219ate <\/span>pentru remediere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Fiecare <\/span>depozit <\/span>de <\/span>jurnale <\/span>de <\/span>audit, <\/span>fi<\/span>e <\/span>c\u0103 <\/span>se <\/span>afl\u0103 <\/span>pe <\/span>un <\/span>server<\/span>, <\/span>un <\/span>firewall\n<\/span>sau <\/span>o <\/span>aplica\u021bie, <\/span>ar <\/span>trebui monitorizat individual \u0219i colectiv<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Serverele <\/span>protocolului <\/span>de <\/span>jurnalizare <\/span>a <\/span>sistemului <\/span>(Syslog)\n<\/span>sau <\/span>solu\u021bii <\/span>similare\n<\/span>de <\/span>jurnalizare centralizat\u0103\nar trebui utilizate pentru sprijinirea colect\u0103rii fiabile a jurnalelor \u0219i\nalertare<\/span>a.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Sistemele <\/span>care <\/span>genereaz\u0103\n<\/span>jurnale <\/span>ar <\/span>trebui <\/span>configurate <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>\u00eenregistreze <\/span>date <\/span>detaliate\nprivind activitatea, accesul \u0219i comportamentul, pentru sus\u021bi<\/span>nerea principiilor zero-trust.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Jurnalele <\/span>de <\/span>audit <\/span>ar <\/span>trebui <\/span>monitorizate <\/span>continuu <\/span>pentru <\/span>asigurarea\n<\/span>disponibilit\u0103\u021bii, <\/span>integrit\u0103\u021bii <\/span>\u0219i capacit\u0103\u021bii <\/span>suficiente <\/span>de <\/span>stocare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-04.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 se\nasigure c\u0103 personalul autorizat poate extinde sa<\/span>u \u00eembun\u0103t\u0103\u021bi capabilit\u0103\u021bile de jurnalizare de audit \u0219i de\nmonitorizare atunci c\u00e2nd este necesar, pentru a sprijini investiga\u021biile sau\nr\u0103spunsul <\/span>la <\/span>incidente.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 jurnalizarea <\/span>auditului\npoate fi adaptat\u0103 rapid pentru a oferi o vizibilitate mai profund\u0103 \u00een timpul\nincidentelor de securitate sau al <\/span>investiga\u021biilor,\nf\u0103r\u0103 a perturba opera\u021biunile normale.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toare<\/span>le:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Sistemele <\/span>de <\/span>jurnalizare <\/span>a <\/span>auditului <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>permit\u0103 <\/span>ajust\u0103ri\n<\/span>la <\/span>cerere, <\/span>precum <\/span>cre\u0219terea\ndetaliilor jurnalului, exti<\/span>nderea\nperioadei de p\u0103strare sau extinderea acoperirii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Personalul autorizat \u0219i condi\u021biile pentru activarea <\/span>jurnaliz\u0103rii extinse ar trebui s\u0103 fie clar\ndefinite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Procedurile de activare ar trebui s\u0103 includ\u0103 aprob\u0103ri,\ndocumenta\u021bie \u0219i urm\u0103rirea modific\u0103rilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cenregistr\u0103rile <\/span>din <\/span>jurnale\n<\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>periodic <\/span>pen<\/span>tru <\/span>asigurarea <\/span>acurate\u021bei <\/span>\u0219i <\/span>exhaustivit\u0103\u021bii\nacestora \u00een toate sistemele <\/span>TIC \u0219i OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Politicile <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>asigure <\/span>c\u0103 <\/span>jurnalizarea\nextins\u0103 <\/span>este u<\/span>tilizat\u0103 <\/span>doar <\/span>atunci\n<\/span>c\u00e2nd <\/span>este <\/span>justificat\u0103 \u0219i \u00eenregistrat\u0103 corespunz\u0103tor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Capacitatea <\/span>tehnic\u0103, <\/span>c\u0103ile <\/span>de <\/span>escaladare <\/span>\u0219i <\/span>disponibilitatea <\/span>personalului <\/span>ar <\/span>trebui <\/span>planificate <\/span>\u00een prealabil pe<\/span>ntru\nsprijinirea activ\u0103rii \u00ee<\/span>n timp util.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Instalarea\n\u0219i executarea software–<\/span>ului\nneautorizat sunt prevenite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Filtre\nweb \u0219i e-mail trebuie instalate \u0219i utilizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>riscul\n<\/span>de <\/span>infectare <\/span>cu <\/span>malware, <\/span>atacuri\n<\/span>de <\/span>phishing <\/span>\u0219i <\/span>bre\u0219e\nde date prin implementarea \u0219i men\u021binerea unor\n<\/span>solu\u021bii eficace de filtrare web \u0219i e<\/span>–<\/span>mail.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea filtr\u0103rii w<\/span>eb<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Filtrele\nweb ar trebui utilizate pentru a controla accesul la site<\/span>-uri web pe baza:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Listelor\npre<\/span>definite de permisiuni\/bloc\u0103ri (de\nexemplu, dup\u0103 URL <\/span>sau domeniu).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Analizei <\/span>con\u021binutului <\/span>\u00een <\/span>timp <\/span>real <\/span>pentru <\/span>detec\u021bia\n<\/span>con\u021binutului <\/span>cu <\/span>s<\/span>cop <\/span>nelegitim\n<\/span>sau inadecvat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>T<\/span>ehnicilor <\/span>precum <\/span>filtrarea <\/span>URL, <\/span>filtrarea <\/span>con\u021binutului, <\/span>filtrarea <\/span>DNS <\/span>\u0219i <\/span>filt<\/span>rarea\n<\/span>pe <\/span>partea clientului sau a\nserverului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Configurare<\/span>a\nfiltr\u0103rii e-mail<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Filtrele\nde e-mail ar tr<\/span>ebui configurate\npentru:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Blocarea <\/span>spamului,\n<\/span>\u00eencerc\u0103rile <\/span>de <\/span>phishing\n<\/span>\u0219i <\/span>ata\u0219amentele <\/span>sau <\/span>linkurile <\/span>cu <\/span>scop <\/span>nelegitim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Clasificarea <\/span>e-mailurilor <\/span>primite <\/span>(de <\/span>exemplu, <\/span>buletine <\/span>informative, <\/span>alerte <\/span>de <\/span>pe <\/span>re\u021belele\nde socializare) pentru reducerea aglomer\u0103rii \u0219i <\/span>\u00eembun\u0103t\u0103\u021birea gradului de con\u0219tientizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Scanarea <\/span>amenin\u021b\u0103rilor <\/span>cunoscute <\/span>\u0219i <\/span>tiparelor\n<\/span>suspecte <\/span>pentru <\/span>\u00eembun\u0103t\u0103\u021birea <\/span>securit\u0103\u021bii e<\/span>–\nmailurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea filtrelor actualizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Regulile <\/span>de <\/span>filtrare\n<\/span>\u0219i <\/span>bazele <\/span>de <\/span>date <\/span>cu <\/span>amenin\u021b\u0103ri <\/span>ar <\/span>trebui <\/span>actualizate <\/span>periodic <\/span>pentru <\/span>a r\u0103spunde amenin\u021b\u0103rilor aflat<\/span>e \u00een continu\u0103 evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu politicile de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Filtrarea <\/span>we<\/span>b <\/span>\u0219i <\/span>e-mail\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>aliniat\u0103\n<\/span>cu <\/span>politicile <\/span>de <\/span>securitate <\/span>\u0219i <\/span>eforturile <\/span>de con\u0219tientizare ale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea considera\u021biilor specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>accesul\n<\/span>la <\/span>internet <\/span>\u0219i <\/span>e-mail <\/span>ar <\/span>trebui <\/span>restric\u021bionat <\/span>numai <\/span>la <\/span>ceea <\/span>ce <\/span>este <\/span>necesar\ndin punct de vedere opera\u021bional. Filtrarea ar trebui aplicat\u0103 ori<\/span>c\u0103ror sisteme cu conectivitate extern\u0103\npentru prevenirea expunerii la amenin\u021b\u0103ri.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-05.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Instalarea\n\u0219i executarea de sof<\/span>tware n<\/span>eautorizat trebuie prevenite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>riscul <\/span>de <\/span>compromitere <\/span>prin <\/span>asigurarea <\/span>faptului\n<\/span>c\u0103 <\/span>pe sisteme sunt instalate\n\u0219i executate exclusiv aplica\u021bii software de \u00eencredere \u0219i apr<\/span>obate.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instalarea \u0219i executarea soft<\/span>ware-ului ar trebui limitat\u0103 la aplica\u021bii \u0219i medii preaprobate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Platformele <\/span>ar <\/span>trebui <\/span>configurate <\/span>pentru <\/span>blocarea <\/span>software<\/span>-ului <\/span>neautori<\/span>zat <\/span>\u0219i <\/span>restric\u021bionarea\nexecut\u0103rii acestuia \u00een cazul \u00een care riscul justific\u0103 aceasta.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sursa \u0219i integritatea tuturor programelor software noi\nar trebui verificate \u00eenainte de instalare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Accesul <\/span>la <\/span>site-uri\n<\/span>web <\/span>d\u0103un\u0103toare <\/span>ar <\/span>trebui <\/span>blocat <\/span>fol<\/span>osind <\/span>servicii <\/span>de <\/span>filtrare <\/span>a <\/span>internetului <\/span>de \u00eencredere \u0219i aprobate, proiectate\npentru detec\u021bia \u0219i oprirea amenin\u021b\u0103rilor online cunoscute.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Acolo <\/span>unde <\/span>este <\/span>fezabil, <\/span>sistemele\n<\/span>ar <\/span>trebui <\/span>configurat<\/span>e <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>permit\u0103 <\/span>instalarea\n<\/span>doar <\/span>a software-ului aprobat de\nor<\/span>ganiza\u021bie<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Practicile <\/span>securizate <\/span>de <\/span>dezvoltare <\/span>a <\/span>software<\/span>-ului <\/span>sunt <\/span>integrate, <\/span>iar <\/span>performan\u021ba <\/span>acestora\n<\/span>este monitorizat\u0103 pe tot parcursul ciclului de via\u021b\u0103 al dezvolt\u0103rii\nsoftware (SDLC).<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

PR.PS-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Securitatea <\/span>trebuie <\/span>luat\u0103 <\/span>\u00een <\/span>considerare <\/span>pe <\/span>tot <\/span>parcur<\/span>sul <\/span>ciclului\n<\/span>de <\/span>via\u021b\u0103 <\/span>al <\/span>sistemelor <\/span>\u0219i <\/span>aplica\u021biilo<\/span>r, indiferent dac\u0103 acestea sunt\ndezvoltate intern sau achizi\u021bionate extern.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>securitatea <\/span>este <\/span>integrat\u0103 <\/span>\u00een <\/span>sisteme <\/span>\u0219i <\/span>aplica\u021bii <\/span>de <\/span>la\n\u00eenceput <\/span>\u0219i <\/span>este <\/span>men\u021binut\u0103 <\/span>pe <\/span>toat\u0103 <\/span>durata <\/span>ciclului <\/span>de <\/span>via\u021b\u0103 <\/span>al <\/span>acestora <\/span>– <\/span>de <\/span>la <\/span>proiectare <\/span>p\u00e2n\u0103 <\/span>la <\/span>retrage<\/span>re<\/span><\/p>\n\n

–\nindiferent dac\u0103 sunt de<\/span>zvoltate\nintern sau achizi\u021bionate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Faza de ini\u021biere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cerin\u021bele <\/span>de <\/span>securitate\n<\/span>ar <\/span>trebui <\/span>definite <\/span>din <\/span>timp, <\/span>riscurile <\/span>identificate, <\/span>iar <\/span>p\u0103r\u021bile <\/span>interesate relevante, inclusiv exper\u021bii \u00een\nsecuritate, implica\u021b<\/span>i de la \u00eenceput.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Faza de achizi\u021bie sau dezvoltare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru\nsolu\u021biile achizi\u021bionate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>V\u00e2nz\u0103torii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>practicile <\/span>de <\/span>dezvoltare <\/span>securizat\u0103, <\/span>s\u0103 <\/span>furnizeze <\/span>dovezi\n<\/span>ale test\u0103rii \u0219i s\u0103 \u00eendeplineasc\u0103 cerin\u021bele contractuale de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru\ndezvoltarea intern\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>T<\/span>rebuie\n<\/span>aplicate <\/span>practici <\/span>de <\/span>codificare <\/span>securizat\u0103, <\/span>gestionate <\/span>modific\u0103ril<\/span>e <\/span>\u0219i <\/span>efectuate\n<\/span>teste de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Faza de implementare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>ar <\/span>trebui <\/span>configurate <\/span>\u00een <\/span>mod <\/span>securizat\n<\/span>\u00eenainte <\/span>de <\/span>punerea\n<\/span>\u00een <\/span>func\u021biune, <\/span>cu <\/span>aplicarea\ncontroalelor de acces \u0219i a cript\u0103rii pentru a proteja datele sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Faza de operare \u0219i mentenan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>ar <\/span>trebui\n<\/span>monitorizate <\/span>pentru <\/span>incidente, <\/span>actualizate <\/span>periodic, <\/span>iar <\/span>controalele <\/span>de securitate revizuite \u0219i \u00eembun\u0103t\u0103\u021bite\n\u00een func\u021bie de necesitate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Faza de casare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>ar <\/span>trebui <\/span>scoase <\/span>din <\/span>uz <\/span>\u0219i <\/span>dezafectate <\/span>\u00een <\/span>mod <\/span>securizat, <\/span>datele <\/span>sensibile <\/span>el<\/span>iminate,\niar lec\u021biile \u00eenv\u0103\u021bate docu<\/span>ment<\/span>ate pentru consolidarea proceselor\nviitoare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-06.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Modific\u0103rile \u0219i excep\u021bii<\/span>le trebuie testate \u0219i validate \u00eenainte de\na fi implementate \u00een sistemele opera\u021bionale<\/span>.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>riscul\n<\/span>de <\/span>\u00eentreruperi <\/span>sau <\/span>vulnerabilit\u0103\u021bi, <\/span>asigur\u00e2nd <\/span>c\u0103 <\/span>toate\nmodific\u0103rile \u0219i <\/span>excep\u021biile <\/span>sunt <\/span>testate <\/span>\u0219i <\/span>validate <\/span>corespunz\u0103tor <\/span>\u00eenainte <\/span>de <\/span>a <\/span>fi <\/span>aplicate <\/span>\u00een <\/span>sistemele opera\u021bionale<\/span>.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een <\/span>considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>oate modific\u0103rile \u0219i excep\u021biile\npropuse ar trebui s\u0103 urmeze un proces formal care include documentarea,\nrevizuirea, testarea \u0219i aprobarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Riscurile poten\u021biale ale aplic\u0103rii sa<\/span>u neaplic\u0103rii unei modific\u0103<\/span>ri ar trebui evaluate \u0219i \u00een<\/span>registrate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Excep\u021biile, <\/span>definite <\/span>ca <\/span>abateri\n<\/span>aprobate <\/span>de <\/span>la <\/span>politicile <\/span>sau <\/span>procedurile <\/span>standard, <\/span>ar <\/span>trebui <\/span>evaluate cu o \u00een\u021belegere clar\u0103 a\nriscurilor \u0219i un <\/span>plan definit pentru\nreduc<\/span>erea sau gestionarea acestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Riscurile <\/span>acceptate <\/span>ar <\/span>tr<\/span>ebui <\/span>revizuite\n<\/span>peri<\/span>odic <\/span>pentru <\/span>a <\/span>confirma\n<\/span>c\u0103 <\/span>decizia <\/span>ini\u021bial\u0103\n<\/span>de <\/span>acceptare a <\/span>acestora\n<\/span>r\u0103m\u00e2ne <\/span>valabil\u0103, <\/span>\u00een <\/span>special <\/span>dac\u0103 <\/span>condi\u021biile <\/span>se <\/span>modific\u0103 <\/span>sau <\/span>dac\u0103 <\/span>acce<\/span>ptarea <\/span>s-a <\/span>bazat <\/span>pe m\u0103suri sau etape viitoare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste  <\/span>practici \n<\/span>ar  <\/span>trebui  <\/span>adaptate \n<\/span>la  <\/span>mediul  <\/span>opera\u021bional \n<\/span>pentru  <\/span>evitarea  <\/span><\/span>perioadelor  <\/span>de nefunc\u021bionare neplanific<\/span>ate sau a problemelor de siguran\u021b\u0103, \u00een\nspecial \u00een sistemele OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-06.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Practicile de dezvoltare securizat\u0103 a\nsoftware-ului trebuie inte<\/span>grate \u00een\ntoate fazele ciclului de via\u021b\u0103 al dezvolt\u0103rii software-ului, iar eficacitatea\nacestora ar trebui monitorizat\u0103 \u0219i \u00eembun\u0103t\u0103\u021bit\u0103 periodic.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce <\/span>riscurile <\/span>de <\/span>securitate <\/span>\u00een <\/span>softwa<\/span>re <\/span>prin <\/span>integrarea <\/span>m\u0103surilor de <\/span>protec\u021bie <\/span>pe <\/span>parcursul <\/span>dezvolt\u0103rii <\/span>\u0219<\/span>i <\/span>\u00eembun\u0103t\u0103\u021birea <\/span>continu\u0103 <\/span>a <\/span>acestora\n<\/span>pe <\/span>baza <\/span>performan\u021bei \u0219i <\/span>a\namenin\u021b\u0103rilor \u00een continu\u0103 evolu\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea securit\u0103\u021bii \u00een ciclul de via\u021b\u0103 al\ndezvolt\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui aplicate standarde de codificare securizat\u0103 \u0219i cadre <\/span>de dezvoltare de \u00eencredere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modelarea\namenin\u021b\u0103rilor ar trebui efectuat\u0103 din ti<\/span>mp\npentru a identifica \u0219i reduce riscurile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate  <\/span><\/span>componentele  <\/span><\/span>software  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>protejate\n <\/span><\/span>\u00eempotriva\n <\/span><\/span>manipul\u0103rii\n <\/span><\/span>\u0219i\n <\/span><\/span>accesului\nneautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui puse \u00een aplicare controale de acces pentru bazele de date \u0219i datele\nsensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dependen\u021bele\nsoftware \u0219i bibliotecile ar trebui s\u0103 fie actualizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software-ul\n\u00eenvechit sau neutilizat ar trebui eliminat \u00een mod securizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea efic<\/span>acit\u0103\u021bii\npracticilor de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui de<\/span>fini\u021bi \u0219i urm\u0103ri\u021bi\nindicatori, precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>V<\/span>ulnerabilit\u0103\u021bile descoperite \u00een timpul\ndezvolt\u0103rii vs. \u00een produc\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>T<\/span>impul necesar pentru remedierea\nproblemelor id<\/span>entificate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Procentul\nde cod revizuit sau testat din punct de <\/span>vedere\nal securit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Participarea\ndezvoltatorilor la cursuri de ins<\/span>truire\n\u00een domeniul cod\u0103rii securizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ace\u0219ti\nindicatori ar trebui utiliza\u021bi pentru identificarea lacunelor \u0219i \u00eembun\u0103t\u0103\u021birea\npracticilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Consolidare<\/span>a\ncon\u0219tientiz\u0103rii privind securitatea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dezvoltatorii <\/span>\u0219i <\/span>echipele <\/span>tehnice <\/span>ar <\/span>tr<\/span>ebui <\/span>s\u0103 <\/span>primeasc\u0103\n<\/span>instruire <\/span>periodic\u0103 <\/span>privind <\/span>principiile\nde codificare \u0219i proiectare securizate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea \u0219i \u00eembun\u0103t\u0103\u021birea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Practicile\nde dezvoltare securizat\u0103 ar trebu<\/span>i\nrevizuite \u0219i actualizate <\/span>pe baza:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Noilor\namenin\u021b\u0103ri sau vulnerabilit\u0103\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Lec\u021biilor\n\u00eenv<\/span>\u0103\u021bate din inc<\/span>idente sau audituri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Standardelor\ndin domeniu \u0219i a bunelor practici.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.PS-06.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru modific\u0103rile\nplanificate ale sistemelor critice ale organiza\u021biei, trebuie efectuat\u0103 o <\/span>analiz\u0103 a impactului <\/span>asupra <\/span>securit\u0103\u021bii <\/span>\u00eentr<\/span>-un <\/span>mediu <\/span>de <\/span>testare\n<\/span>separat, <\/span>\u00eenainte <\/span>de <\/span>implementarea <\/span>\u00eentr<\/span>-un <\/span>mediu opera\u021bional.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a preveni riscurile de securitate neinten\u021bionate prin testarea\nmodific\u0103ril<\/span>or <\/span>planificate <\/span>ale <\/span>sistemelor <\/span>critice <\/span>\u00eentr<\/span>-un <\/span>mediu <\/span>controlat <\/span>\u00eenainte <\/span>de <\/span>punerea\n<\/span>\u00een <\/span>func\u021biu<\/span>ne. \u00cen vederea realiz\u0103rii acestui\nobiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Planificarea <\/span>scenariului <\/span>de <\/span>testare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>identificate <\/span>amenin\u021b\u0103rile <\/span>la <\/span>ad<\/span>resa <\/span>securit\u0103\u021bii <\/span>sistemelor<\/span>, <\/span>activelor<\/span>, <\/span>proceselor <\/span>\u0219<\/span>i persoanelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modific\u0103rile <\/span>planificate <\/span>ale <\/span>configura\u021biei <\/span>sau <\/span>modific\u0103rile <\/span>sistemului <\/span>ar <\/span>treb<\/span>ui <\/span>analizate <\/span>\u00een <\/span>ceea\nce prive\u0219te impactul lor poten\u021bial asu<\/span>pra\nsecurit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Preg\u0103tirea mediului de testare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele\nde testare ar trebui s\u0103 <\/span>reflecte\nscenarii opera\u021bionale realiste.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cerin\u021bele\nhardware, software \u0219i de re\u021bea ar trebui definite clar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mediul <\/span>de <\/span>testare\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>reflecte <\/span>c\u00e2t <\/span>mai <\/span>fidel <\/span>mediul <\/span>de <\/span>produc\u021bie <\/span>\u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te\ninstalarea \u0219i configurarea<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui alocat spa\u021biu suficient pe disc pentru activit\u0103\u021bile de testare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>ersiunile\nsoftware din mediul de testare ar trebui s\u0103 corespund\u0103 cu cele <\/span>din produc\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea securit\u0103\u021bii \u0219i a mentenabilit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software-ul  <\/span> <\/span><\/span>din  <\/span> <\/span><\/span>mediul \n<\/span> <\/span><\/span>de \n<\/span> <\/span><\/span>testa<\/span>re  <\/span> <\/span><\/span>ar \n<\/span> <\/span><\/span>trebui \n<\/span> <\/span><\/span>actu<\/span>a<\/span>lizat \n<\/span> <\/span><\/span>periodic  <\/span> <\/span><\/span>pentru \n<\/span> <\/span><\/span>remedierea vulnerabilit\u0103\u021bilor\ncunoscute.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ehnologiile <\/span>de <\/span>virtualizare <\/span>sau <\/span>containerizare <\/span>ar <\/span>trebui <\/span>utilizate <\/span>pentru <\/span>crearea <\/span>unor <\/span>medii\nconsecvente \u0219i replicabile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>VM-urile\nizolate ar trebui utilizate pentru a preveni interferen\u021ba cu <\/span>sistemele opera\u021bionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediul <\/span>de <\/span>testare <\/span>ar <\/span>trebui <\/span>implementate <\/span>controale <\/span>de <\/span>securitate, <\/span>precum <\/span>firewall<\/span>-uri <\/span>\u0219i\nrestric\u021bii de acces.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[PR.IR]\nREZILIEN\u021aA INFRASTRUCTURII TEHNOLOGICE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Arhitecturile de securitate sunt\ngestionate \u00een <\/span>conformitate cu\nstrategia de management al riscului al organiza\u021biei, <\/span>pentru <\/span>prot<\/span>ejarea\n<\/span>confiden\u021bialit\u0103\u021bii, <\/span>int<\/span>egrit\u0103\u021bii \u0219i <\/span>disponibilit\u0103\u021bii <\/span>activelor, <\/span>precum <\/span>\u0219i\nrezilien\u021ba organiza\u021bional\u0103.<\/span><\/p>\n\n

PR.IR-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Re\u021belele \u0219i mediile sunt prot<\/span>ejate \u00eempotriva <\/span>accesului\n\u0219i utiliz\u0103rii logice neautorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Firewall-urile trebuie instalate,\nconfigurate \u0219i men\u021binute \u00een mod activ pe toate re\u021belele utilizate de\norganiza\u021bie <\/span>pentru a proteja\n\u00eempotriva accesului neautorizat \u0219i a amenin\u021b\u0103rilor cibernetice.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Con<\/span>trol este de a asigura protejarea tuturor\nre\u021belelor utilizate de organiza\u021bie \u00eempotriva accesului neautorizat \u0219i a\namenin\u021b\u0103rilor cibernetice prin instalarea, configurarea \u0219i mentenan\u021ba activ\u0103 a\nfirewall<\/span>-urilor.<\/span><\/p>\n\n

Acest Control se\nconcentreaz\u0103 pe instalarea, configurarea \u0219i mentenan\u021ba firewall<\/span>–u<\/span>rilor\nla nivel de re\u021bea pentru prevenirea accesului neautorizat prin monitorizarea \u0219i\ncontrolul traficului care intr\u0103 sau iese <\/span>din <\/span>re\u021bea <\/span>(accent:\ncontrol <\/span>\u0219i <\/span>preven\u021bie). <\/span>\u00cen <\/span>schimb,\n<\/span>C<\/span>ontrolul <\/span>DE.CM-01.1 <\/span>se <\/span>refer\u0103 <\/span>la <\/span>fire<\/span>wall<\/span>–\nurile la nivel de host, care <\/span>contribuie\nla detec\u021bia amenin\u021b\u0103rilor care ocolesc perimetrul re\u021belei prin monitorizarea\ntraficului c\u0103tre \u0219i de la dispozitive individuale (accent: vizibilitate \u0219i\ndetec\u021bie).<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea <\/span>perimetrului <\/span>re\u021belei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un <\/span>firewall <\/span>ar <\/span>trebui <\/span>instalat\n<\/span>\u00eentre <\/span>re<\/span>\u021beaua <\/span>intern\u0103 <\/span>\u0219i <\/span>internet. <\/span>Acesta <\/span>poate <\/span>fi <\/span>integrat <\/span>\u00eentr-un punct de acces wireless, un router\nsau un echipament <\/span>furnizat de ISP<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Firewall-urile <\/span>ar <\/span>trebui\n<\/span>configurate <\/span>pe <\/span>baza <\/span>unei <\/span>politici\n<\/span>de <\/span>securitate <\/span>de <\/span>baz\u0103, <\/span>aplic\u00e2nd principiul refuz\u0103 totul \u00een mod\nimpl<\/span>icit, permite nu<\/span>mai excep\u021biile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Securizarea dispozitivelor endpoint<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un <\/span>firewall\n<\/span>software <\/span>ar <\/span>trebui <\/span>instalat <\/span>\u0219i <\/span>a<\/span>ctualizat\n<\/span>periodic <\/span>pe <\/span>toate <\/span>dispozitivele <\/span>endpoint, inclusiv laptopuri,\nsmartphone-uri \u0219i alte sisteme conectate la re\u021bea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Firewall-urile <\/span>locale ar\n<\/span>tr<\/span>ebui <\/span>s\u0103 <\/span>r\u0103m\u00e2n\u0103 <\/span>active <\/span>chiar <\/span>\u0219i <\/span>atunci <\/span>c\u00e2nd <\/span>se <\/span>utilizeaz\u0103 <\/span>VPN<\/span>-uri <\/span>sau servicii <\/span>cloud.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Securizarea mediilor de lucru de acas\u0103 \u0219i la distan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Re\u021belele <\/span>domestice\n<\/span>utilizate <\/span>pentru <\/span>telemunc\u0103\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>utilizeze <\/span>routere\n<\/span>cu <\/span>firewall <\/span>integrat, care ar trebui activate,\nconfigurate \u00een mod securizat \u0219i men\u021binute actualizate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Firewall-urile <\/span>software <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>act<\/span>ive <\/span>\u0219i <\/span>actualizate <\/span>pe <\/span>toate <\/span>dispozitivele <\/span>utilizate pentru munca la distan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>de <\/span>acces <\/span>implicite <\/span>ale <\/span>administratorului <\/span>ale <\/span>routerelor <\/span>domestice\n<\/span>ar <\/span>trebui <\/span>modificate \u0219i actualizate periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea mediilor OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>la <\/span>distan\u021b\u0103\n<\/span>la <\/span>sistemele <\/span>OT <\/span>ar <\/span>trebui <\/span>tratat <\/span>ca <\/span>acces <\/span>al <\/span>unei <\/span>p\u0103r\u021bi <\/span>ter\u021be, <\/span>nu <\/span>ca <\/span>telemunc\u0103 standard.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui pus\u0103 \u00een aplicare o separare clar\u0103 \u00eentre re<\/span>\u021belele IT <\/span>\u0219i OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Atunci <\/span>c\u00e2nd <\/span>este <\/span>necesar <\/span>accesul <\/span>IT<\/span>-c\u0103tre-OT<\/span>, <\/span>acesta <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>treac\u0103 <\/span>printr<\/span>-un <\/span>host <\/span>jump securizat <\/span>situat <\/span>\u00eentr<\/span>-o <\/span>zon\u0103 <\/span>demilitarizat\u0103 <\/span>(DMZ) <\/span>dedicat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cembun\u0103t\u0103\u021birea detec\u021biei printr<\/span>-un sistem de detec\u021bie \u0219i prevenire a intruziunilor (IDPS)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un <\/span>IDPS <\/span>ar <\/span>trebui <\/span>avut <\/span>\u00een <\/span>vedere\n<\/span>pentru <\/span>monitorizarea <\/span>\u0219i <\/span>analizarea <\/span>traficului <\/span>de <\/span>re\u021bea <\/span>\u00een vederea identific\u0103rii activit\u0103\u021bilor s<\/span>uspecte \u0219i pentru consolidarea protec\u021biei\ngenerale.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru <\/span>protejarea <\/span>sistemelor <\/span>critice,\n<\/span>organiza\u021biile <\/span>trebuie <\/span>s\u0103 <\/span>implementeze <\/span>segmentarea <\/span>\u0219i <\/span>segregarea\nre\u021belelor \u00een conformitate cu limitele de \u00eencredere \u0219i criticitatea activelor,\nlimit\u00e2nd as<\/span>tfel propagarea\namenin\u021b\u0103rilor \u0219i impun\u00e2nd un control strict al accesului.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>limita\n<\/span>r\u0103sp\u00e2ndirea <\/span>amenin\u021b\u0103rilor <\/span>cibernetice <\/span>\u0219i <\/span>a <\/span>pune <\/span>\u00een <\/span>aplicare un <\/span>control <\/span>strict <\/span>al <\/span>accesului <\/span>p<\/span>rin <\/span>im<\/span>plementarea <\/span>segment\u0103rii <\/span>\u0219i <\/span>segreg\u0103rii <\/span>re\u021belei\n<\/span>pe <\/span>baza <\/span>limitelor <\/span>de \u00eencredere \u0219i a criticit\u0103\u021bii sistemelor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea zonelor de securitate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Re\u021belele\nar trebui \u00eemp\u0103r\u021bite \u00een zone distincte (de exemplu, birou, produc\u021bie,\nvizitatori, mobil).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

T<\/span>raficul dint<\/span>re zone ar tr<\/span>ebui monitorizat \u0219i controlat, de exemplu <\/span>folosind firewall<\/span>-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea segment\u0103rii cu \u00eencrederea \u0219i criticitatea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Segmentarea <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>reflecte <\/span>ce <\/span>utilizatori <\/span>\u0219i <\/span>sist<\/span>eme <\/span>sun<\/span>t <\/span>de <\/span>\u00eencredere <\/span>\u0219i <\/span>c<\/span>\u00e2t <\/span>d<\/span>e <\/span>critic <\/span>este fiecare <\/span>activ<\/span>. <\/span>Ar <\/span>trebui <\/span>permis\u0103 <\/span>doar <\/span>comunicarea <\/span>esen\u021bial\u0103 <\/span>\u00eentr<\/span>e <\/span>zone, <\/span>respect\u00e2nd\n<\/span>prin<\/span>cipiul privilegiului\nminim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evitarea re\u021belelor nesegmentate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Re\u021belele <\/span>nesegmentate <\/span>ar <\/span>trebui <\/span>evitate,\n<\/span>de<\/span>oarece <\/span>compromiterea <\/span>unui <\/span>singur <\/span>sistem\n<\/span>poate expune \u00eentregul mediu. Segmentarea ar trebui s\u0103 contribuie la\nizolarea amenin\u021b\u0103rilor \u00eentr-o singur\u0103 zon\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Separarea mediilor IT\n<\/span>\u0219i OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile\n<\/span>cu <\/span>sisteme <\/span>industriale <\/span>(OT), <\/span>re\u021belele <\/span>de <\/span>birou <\/span>\u0219i <\/span>de <\/span>produc\u021bie\n<\/span>ar <\/span>trebui <\/span>separate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Re\u021belele pentru\nvizitatori \u0219i cele mobile nu ar trebui s\u0103 aib\u0103 acces direct la sistemele\ninterne de <\/span>birou <\/span>sau <\/span>de <\/span>produc\u021bie. <\/span>Segmentarea <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>respecte <\/span>standardul <\/span>IEC <\/span>62443, <\/span>\u00een <\/span>special\ncerin\u021bele SR 5.1 p\u00e2n\u0103 la SR 5.3.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea <\/span>VLAN-urilor <\/span>cu pruden\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>VLAN-urile <\/span>ar <\/span>trebui\n<\/span>utilizate <\/span>doar <\/span>ca <\/span>parte <\/span>a <\/span>unei <\/span>strategii <\/span>de <\/span>ap\u0103rare <\/span>\u00een <\/span>profunzime <\/span>mai ample. <\/span>Nu <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>se <\/span>bazeze <\/span>numai <\/span>pe <\/span>acestea <\/span>pentru\n<\/span>\u00eendeplinirea <\/span>cerin\u021belor <\/span>de <\/span>Securitate\nde <\/span>Nivel <\/span>2 <\/span>prev\u0103zute <\/span>\u00een <\/span>IEC <\/span>62443<\/span>-3-3.\nVLAN-urile <\/span>ar <\/span>trebui <\/span>combinate <\/span>cu <\/span>firewall<\/span>-uri, controale de acces \u0219i monitorizare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na segment\u0103rii prin firewall<\/span>-uri<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Firewall-urile <\/span>ar <\/span>trebui <\/span>configurate <\/span>s\u0103 <\/span>blocheze <\/span>tot <\/span>traficul <\/span>\u00een <\/span>mod <\/span>implic<\/span>it <\/span>\u0219i <\/span>s\u0103 <\/span>permit\u0103\n<\/span>doar conexiunile specifice, aprobate. <\/span>Segmentarea\n\u0219i segregarea ar trebui puse \u00een aplicare prin reguli de firewall bine\nmen\u021binute, \u00een conformitate cu Controlul PR.IR<\/span>-01.1.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Clarificarea diferen\u021belor dintre segmentare \u0219i\nsegregare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Segmentarea <\/span>ar <\/span>trebui <\/span>utilizat\u0103 <\/span>pentru <\/span>\u00eemp\u0103r\u021birea <\/span>\u00een <\/span>mod <\/span>logic <\/span>r<\/span>e\u021belelor\n<\/span>\u0219i <\/span>controlul <\/span>traficului dintre zone.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Segregarea <\/span>ar <\/span>trebui\n<\/span>aplicat\u0103 <\/span>acolo <\/span>unde <\/span>sistemele <\/span>trebuie\n<\/span>izolate, <\/span>f\u0103r\u0103 <\/span>comunicare <\/span>direct\u0103, <\/span>cu excep\u021bia\ncazurilor permise explicit.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru <\/span>asigurarea <\/span>stabilit\u0103\u021bii <\/span>\u0219i <\/span>securit\u0103\u021bii <\/span>opera\u021bionale, <\/span>orga<\/span>niza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>identifice, <\/span>documenteze \u0219i controleze conexiunile\ndintre comp<\/span>onentele sistemelor sale\ncritice, f\u0103r\u0103 excep\u021bie.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>men\u021bine <\/span>stab<\/span>ilitatea <\/span>\u0219i <\/span>securitatea <\/span>opera\u021bionale <\/span>prin <\/span>asigurarea <\/span>c\u0103 toate\n<\/span>conexiunile <\/span>dintre <\/span>componentele <\/span>sistemelor <\/span>critice <\/span>sunt <\/span>cunoscute, <\/span>documentate <\/span>\u0219i <\/span>gestionate <\/span>\u00een mod activ.<\/span><\/p>\n\n

\u00cen\n<\/span>mediile <\/span>O<\/span>T, <\/span>conexiunile <\/span>nedocumentate <\/span>sau <\/span>necontrolate <\/span>– <\/span>fie <\/span>ele <\/span>fizice<\/span>, <\/span>wireless <\/span>sau <\/span>logice <\/span>– <\/span>pot\nintroduce vu<\/span>lnerabilit\u0103\u021bi, pertur<\/span>ba proces<\/span>ele\nsau ocoli mecanismele de siguran\u021b\u0103.<\/span><\/p>\n\n

Pentru  <\/span><\/span>gestionarea  <\/span><\/span>\u0219i  <\/span><\/span>securizarea\n <\/span><\/span>\u00een\n <\/span><\/span>mod\n <\/span><\/span>eficace\n <\/span><\/span>a\n <\/span><\/span>conexiunilor\n <\/span><\/span>de\n <\/span><\/span>re\u021bea\n <\/span><\/span>\u00eentre\n <\/span><\/span>componentele\nsistemului, ar trebui luate \u00een considerare urm\u0103toarele practici:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Managemen<\/span>tul\nconfigura\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021biile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>implementeze <\/span>proce<\/span>se <\/span>de <\/span>management <\/span>al <\/span>configura\u021biei <\/span>pentru\n<\/span>a asigura c\u0103 toate modific\u0103rile aduse conexiunilor de re\u021bea sunt\ndocumentate, revizuite \u0219i aprobate. Fi\u0219ierele de configurare \u0219i jurnalele ar\ntrebui s\u0103 fie actualizate \u0219i men\u021binute \u00een mod securizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controale de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>puse <\/span>\u00een <\/span>aplicare\n<\/span>controale <\/span>stricte <\/span>de <\/span>acces <\/span>pentru <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>numai <\/span>personalul autorizat poate modifica\nconfigura\u021biile re\u021belei. RBAC ar trebui utilizat pentru restric\u021bionarea\naccesului \u00een func\u021bie de re<\/span>sponsabilit\u0103\u021bile\npostu<\/span>lui \u0219i de necesit\u0103\u021bile\nopera\u021bionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Audituri periodice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>efectuate <\/span>audituri <\/span>periodice <\/span>pentru\n<\/span>a <\/span>verifica <\/span>dac\u0103 <\/span>toate <\/span>conexiunile <\/span>documentate r\u0103m\u00e2n corecte \u0219i dac\u0103 nu au avut loc modific\u0103ri\nneautorizate. Rezultatele auditului ar trebui utilizate pentru actualizarea\ndocumenta\u021biei \u0219i consolidarea controalelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Leg\u0103tur\u0103 <\/span>cu <\/span>Managemen<\/span>tul <\/span>activelor <\/span>(ID.AM)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Conexiunile <\/span>dintre <\/span>componentele <\/span>sistemului <\/span>ar <\/span>trebui <\/span>docume<\/span>ntate <\/span>\u00een <\/span>ID.AM <\/span>(Managementul\nactivelor) <\/span>\u0219i <\/span>controlate <\/span>\u00een <\/span>conformi<\/span>tate <\/span>cu <\/span>aceast\u0103 <\/span>cerin\u021b\u0103\n<\/span>(PR.I<\/span>R-01.3) <\/span>pentru asigurarea coeren\u021bei,\ntrasabilit\u0103\u021bii \u0219i aplicabilit\u0103\u021bii \u00een arhitectura de securitate cibernetic\u0103 din\ncadrul or<\/span>ganiza\u021biei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>implementeze <\/span>m\u0103suri adecvate <\/span>de <\/span>protec\u021bie <\/span>a <\/span>grani\u021belor <\/span>pentru <\/span>monitoriz<\/span>area \u0219i <\/span>controlul <\/span>comunica\u021biilor <\/span>la <\/span>grani\u021bele <\/span>externe \u0219i\n<\/span>interne <\/span>cheie <\/span>ale <\/span>sistemelor <\/span>sale <\/span>critice, <\/span>at\u00e2t <\/span>\u00een\nmediile IT, c\u00e2t \u0219i \u00een cele OT, pentru a asigura op<\/span>era\u021biuni securizate \u0219i fiabile.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>opera\u021biuni\n<\/span>securizate \u0219i <\/span>fiabile <\/span>prin <\/span>monitorizarea <\/span>\u0219i controlul activ al comunica\u021biilor la\ngrani\u021bele cheie ale re\u021belei, \u00een special acolo unde sistemele critice\ninterac\u021bioneaz\u0103 cu re\u021bele externe sau zone interne mai pu\u021bin fiabile.<\/span><\/p>\n\n

\u00cen <\/span>mediile <\/span>OT, <\/span>unde <\/span>sistemele <\/span>vechi <\/span>nu <\/span>dispun <\/span>adesea <\/span>de <\/span>securitate <\/span>integrat\u0103, <\/span>protec\u021bia <\/span>grani\u021belor <\/span>este esen\u021bial\u0103 pentru prevenirea accesului\nneautorizat, limitarea poten\u021bialelor amenin\u021b\u0103ri \u0219i men\u021binerea integrit\u0103\u021bii\nproceselor \u00een domeniile IT \u0219i OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii\n<\/span>acestui obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Dispozitive <\/span>de <\/span>protec\u021bie <\/span>a <\/span>grani\u021belor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Firewall-urile, <\/span>gateway-urile <\/span>de <\/span>securitate <\/span>\u0219i <\/span>routerele <\/span>ar <\/span>tr<\/span>ebui <\/span>implementate <\/span>la <\/span>grani\u021bele\nexterne <\/span>\u0219i <\/span>interne <\/span>pentru <\/span>punerea\n<\/span>\u00een <\/span>aplicare <\/span>a <\/span>politicilo<\/span>r <\/span>de <\/span>filtrare\n<\/span>\u0219i <\/span>rutare <\/span>a <\/span>traficului. <\/span>Aceste dispozitive a<\/span>r trebui s\u0103 func\u021bioneze dup\u0103 modelul\nrefuz implicit, acceptare prin excep\u021bie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Zonarea \u0219i izolarea \u00een mediile OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>protec\u021bia <\/span>grani\u021belor <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>includ\u0103 <\/span>separarea <\/span>strict\u0103 <\/span>\u00eentre <\/span>sistemele <\/span>de control \u0219i re\u021belele externe. Zonele ar trebui definite \u00een\nfunc\u021bie de criticitate \u0219i \u00eencredere, iar comunica\u021biile \u00eentre zone ar trebui\ncontrolate \u0219i monitorizate cu stricte\u021be.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Gateway-uri <\/span>unidirec\u021bionale\n(diode de date)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>cazul <\/span>\u00een <\/span>care <\/span>datele <\/span>tr<\/span>ebuie <\/span>s<\/span>\u0103 <\/span>circule <\/span>de <\/span>la <\/span>sisteme <\/span>OT <\/span>securizate\n<\/span>c\u0103tre <\/span>destina\u021bii <\/span>externe (de exemplu, servicii cloud sau\nautorit\u0103\u021bi de reglementare), ar trebui utilizate gateway<\/span>-uri unidirec\u021bionale pentru prevenirea amenin\u021b\u0103rilor interne,\npermi\u021b\u00e2nd \u00een acela\u0219i timp transferul de date externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Comunica\u021bii criptate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunica\u021biile <\/span>care <\/span>traverseaz\u0103 <\/span>grani\u021bele <\/span>ar <\/span>trebui <\/span>criptate <\/span>utiliz\u00e2nd\n<\/span>protocoale <\/span>securizate <\/span>(de exemplu, V<\/span>PN, TLS) <\/span>pentru <\/span>protejarea <\/span>datelor <\/span>\u00een <\/span>tranzit\n<\/span>\u0219i <\/span>asigurarea <\/span>confiden\u021bialit\u0103\u021bii <\/span>\u0219i integrit\u0103\u021bii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Detec\u021bia \u0219i prevenirea <\/span>intruziunilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>IDPS-urile <\/span>ar <\/span>trebui <\/span>implementate <\/span>la <\/span>grani\u021bele <\/span>cheie <\/span>pentru <\/span>monitorizarea <\/span>traficului <\/span>\u00een <\/span>vederea detec\u021biei anomaliilor<\/span>, a \u00eencerc\u0103rilor de acces neautorizat \u0219i\nblocarea activit\u0103\u021bilor cu scop nelegitim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Punerea \u00een a<\/span>plicare\na controlului accesul<\/span>ui<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul  <\/span><\/span>la  <\/span><\/span>dispozitivele  <\/span><\/span>de  <\/span><\/span>grani\u021b\u0103  <\/span><\/span>\u0219i  <\/span><\/span>canalele\n <\/span><\/span>de\n <\/span><\/span>comunicare\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>restric\u021bionat\n <\/span><\/span>la\npersonalul <\/span>autorizat. Ar <\/span>trebui <\/span>luate <\/span>\u00een <\/span>considerare <\/span>solu\u021bii\n<\/span>de <\/span>control <\/span>al <\/span>accesului <\/span>la <\/span>re\u021bea\n(NAC) <\/span>pentru <\/span>a <\/span>pune <\/span>\u00een <\/span>aplicare <\/span>autentificarea <\/span>dispozitivelor \u0219i <\/span>a <\/span>uti<\/span>lizatorilor <\/span>la <\/span>punctele <\/span>de intrare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea continu\u0103 \u0219i aplicarea de patch-uri<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitivele <\/span>de <\/span>grani\u021b\u0103\n<\/span>\u0219i <\/span>canalele <\/span>de <\/span>comunicare <\/span>ar <\/span>trebui <\/span>monitorizate <\/span>continuu <\/span>pentru\ndetec\u021bia <\/span>activit\u0103\u021bilor <\/span>suspecte. T<\/span>oate <\/span>sistemele <\/span>expuse <\/span>la <\/span>comunica\u021bii <\/span>externe <\/span>sau <\/span>interzonale ar trebui actualizate \u0219i\nremediate periodic pentru remedierea vulnerabilit\u0103\u021bilor cunoscute.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.5<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>implementeze, <\/span>acolo\n<\/span>unde <\/span>este <\/span>fezabil,\n<\/span>servere <\/span>proxy <\/span>autentificate <\/span>sau <\/span>firewall<\/span>– uri <\/span>cu <\/span>filtrare\n<\/span>URL <\/span>\u0219i <\/span>c<\/span>a<\/span>pabilit\u0103\u021bi <\/span>de <\/span>informa\u021bii privind <\/span>amenin\u021b\u0103rile <\/span>pentru <\/span>traficul <\/span>de <\/span>comunica\u021bii\ndefinit \u00eentre sistemele sa<\/span>le critice\n\u0219i r<\/span>e\u021belele externe.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>reduce\n<\/span>riscul <\/span>de <\/span>amenin\u021b\u0103ri <\/span>cibernetice <\/span>care <\/span>p\u0103trund\n<\/span>\u00een <\/span>sistem<\/span>ele critice, prin filtrarea \u0219i inspectarea\ncomunica\u021biilor de ie\u0219ire \u0219i de intrare prin proxy<\/span>-uri autentificate sau firewall-uri.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controale de acces<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Serverele <\/span>proxy <\/span>\u0219i <\/span>firewall-urile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>pun\u0103 <\/span>\u00een <\/span>aplicare <\/span>controale\n<\/span>stricte <\/span>de <\/span>acces, permi\u021b\u00e2nd accesul numai utilizatoril<\/span>or \u0219i sistemelor autorizate. Pentru\nsus\u021binerea prin<\/span>cipiilor zero-trust,\nar trebui utilizate metode de autentificare puternice, <\/span>precum MF<\/span>A.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Criptarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunica\u021biile <\/span>dintre <\/span>clien\u021bi <\/span>\u0219i <\/span>serverele\n<\/span>proxy <\/span>ar <\/span>trebui <\/span>criptate <\/span>utiliz\u00e2nd\n<\/span>cele <\/span>mai <\/span>recente <\/span>\u0219i securizate\nversiuni ale SSL\/TLS pentru protec\u021bie \u00eempotriva intercept\u0103rii \u0219i atacurilor de\ntip man-in-the-middle.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Informa\u021bii privind amenin\u021b\u0103rile \u0219i <\/span>filtrarea URL-urilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>monitorizarea <\/span>\u0219i <\/span>controlul <\/span>efectiv\n<\/span>al <\/span>comunica\u021biilor <\/span>din <\/span>mediile <\/span>IT <\/span>\u0219i <\/span>OT<\/span>, <\/span>serverele proxy \u0219i firewall-urile ar\ntrebui:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>S\u0103  <\/span>integreze <\/span>fluxurile  <\/span>de \n<\/span>informa\u021bii  <\/span>privind  <\/span>amenin\u021b\u0103rile \n<\/span>pentru  <\/span>detec\u021bia  <\/span>\u0219i \n<\/span>blocarea domeniilor<\/span>,\nadreselor IP <\/span>\u0219i URL-urilor c<\/span>unoscute ca fiind cu scop nelegitim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>S\u0103 <\/span>aplice <\/span>filtrarea <\/span>URL-urilor <\/span>pentru <\/span>\u00eempiedicarea <\/span>accesului\n<\/span>la <\/span>con\u021binut <\/span>we<\/span>b <\/span>d\u0103un\u0103tor\n<\/span>sau neautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>unde <\/span>sistemele <\/span>nu <\/span>dispun <\/span>adesea <\/span>de <\/span>func\u021bii\n<\/span>de <\/span>securitate <\/span>integrate, <\/span>ar <\/span>trebui utilizat\u0103\nfiltrarea inteligent\u0103 la grani\u021b<\/span>ele\nre\u021belei pentru:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Detec\u021bia <\/span>\u0219i <\/span>blocarea <\/span>traficului <\/span>cu <\/span>scop <\/span>nelegitim\n<\/span>\u00eenainte <\/span>ca <\/span>acesta <\/span>s\u0103 <\/span>ajung\u0103 <\/span>la <\/span>sistemele critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Prevenirea\nexfiltr\u0103rii datelor \u0219i comunicarea exte<\/span>rn\u0103\nneautorizat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Punerea\n\u00een a<\/span>plicare a politicilor de\ncomunicare f\u0103r\u0103 perturbare<\/span>a\nproceselor opera\u021bionale.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>m\u0103suri <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fac\u0103 <\/span>parte <\/span>dintr<\/span>-o <\/span>strategie <\/span>de <\/span>ap\u0103rare <\/span>pe <\/span>mai <\/span>multe <\/span>niveluri, <\/span>care s\u0103 sprijine o<\/span>pera\u021biuni securizate \u0219i fiabile at\u00e2t \u00een domeniul IT<\/span>, c\u00e2t \u0219i \u00een cel OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Jurnalizarea <\/span>\u0219i <\/span>monitorizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnalizarea <\/span>detaliat\u0103 <\/span>\u0219i <\/span>monitorizarea <\/span>continu\u0103\n<\/span>ar <\/span>trebui <\/span>activate\n<\/span>pentru <\/span>urm\u0103rirea <\/span>accesului, detec\u021bia anomaliilor \u0219i\nsprijinirea r\u0103spunsului la incidente. Jurnalele ar trebui revizuite periodic\npentru detec\u021bia semnelor de compromite<\/span>re.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Configurare<\/span>a\nfirewall-ului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Firewall-urile <\/span>ar <\/span>trebui\n<\/span>configurate <\/span>astfel <\/span>\u00eenc\u00e2t\n<\/span>s\u0103 <\/span>permit\u0103 <\/span>numai\n<\/span>traficul <\/span>autorizat <\/span>\u00een <\/span>mod\nexplicit <\/span>c\u0103tre <\/span>\u0219i <\/span>dinspre <\/span>serverele <\/span>proxy<\/span>. <\/span>Ar <\/span>trebui <\/span>pus\u0103 <\/span>\u00een <\/span>aplicare\n<\/span>o <\/span>politic\u0103 <\/span>de <\/span>refuz <\/span>implicit<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualiz\u0103ri \u0219i aplicare de patch-uri periodice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Serverele <\/span>proxy<\/span>, <\/span>firewall-urile <\/span>\u0219i <\/span>sistemele <\/span>lor <\/span>de <\/span>baz\u0103 <\/span>ar <\/span>trebui\n<\/span>actualizate <\/span>\u0219i <\/span>s\u0103 <\/span>le <\/span>fie <\/span>aplicate\npatch-uri periodic pentru remedierea vulnerabilit\u0103\u021bilor cunoscute \u0219i pentru\nmen\u021binerea eficacit\u0103\u021bii securit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Performan\u021b\u0103 \u0219i fiabili<\/span>tate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Echilibrarea <\/span>sarcinii <\/span>ar <\/span>trebui <\/span>utilizat\u0103 <\/span>pentru <\/span>distribuirea <\/span>tr<\/span>aficului <\/span>\u00eentre\n<\/span>mai <\/span>multe <\/span>servere proxy <\/span>sau <\/span>firewall-uri, <\/span>asigur<\/span>\u00e2nd <\/span>o <\/span>disponibilitate <\/span>ridicat\u0103\n<\/span>\u0219i <\/span>o <\/span>performan\u021b\u0103 <\/span>optim\u0103. <\/span>Utilizarea resurselor ar trebui\nmonitorizat\u0103 pentru prev<\/span>enirea supra<\/span>\u00eenc\u0103rc\u0103rii \u0219i degrad\u0103rii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.6<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>se <\/span>asigure <\/span>c\u0103 <\/span>sistemele <\/span>sale <\/span>critice <\/span>sunt <\/span>proiectate <\/span>astfel\n<\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>cedeze\n<\/span>\u00een <\/span>mod securizat \u0219i s\u0103 r\u0103m\u00e2n\u0103\nprotejate \u00een cazul unei defec\u021biuni opera\u021bionale a unui dispozitiv de protec\u021bie\na grani\u021be<\/span>lor.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\nc\u0103 <\/span>sistemele <\/span>critice <\/span>r\u0103m\u00e2n <\/span>protejate\n<\/span>\u0219i <\/span>nu <\/span>devin <\/span>expuse sau <\/span>vulnerabile <\/span>\u00een <\/span>cazul <\/span>\u00een <\/span>care <\/span>un firewall, <\/span>un proxy <\/span>sau <\/span>alt <\/span>dispozitiv <\/span>de <\/span>protec\u021bie <\/span>a <\/span>grani\u021belor <\/span>se defecteaz\u0103.<\/span><\/p>\n\n

\u00cen mediile OT, unde\ndisponibilitatea \u0219i siguran\u021ba sunt esen\u021biale, sistemele ar trebui proiectate\nastfel \u00eenc\u00e2t <\/span>s\u0103 <\/span>cedeze\n<\/span>\u00een <\/span>mod <\/span>securizat, <\/span>de <\/span>exemplu,\n<\/span>trec\u00e2nd <\/span>\u00een <\/span>mod <\/span>implicit <\/span>la <\/span>o <\/span>stare\n<\/span>de <\/span>refuz <\/span>total,\n<\/span>izol\u00e2nd segmentele afectate sau declan\u0219\u00e2nd alerte, astfel \u00eenc\u00e2t o def<\/span>ec\u021biune a unei componente s\u0103 nu compromit\u0103 <\/span>\u00eentregul sistem \u0219i s\u0103 nu permit\u0103 accesul\nneautorizat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Configura\u021bie sigur\u0103 \u00een caz de defec\u021biune<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitivele <\/span>ar <\/span>trebui\n<\/span>configurat<\/span>e <\/span>astfel\n<\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>treac\u0103\n<\/span>automat <\/span>\u00eentr<\/span>-o <\/span>stare <\/span>sigur\u0103 <\/span>(de\nexemplu, <\/span>s\u0103 <\/span>blocheze <\/span>tot <\/span>traficul) \u00een <\/span>cazul <\/span>unei <\/span>defec\u021biuni, <\/span>pentru <\/span>prevenirea <\/span>accesului neautorizat sau scur<\/span>gerea de date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Redundan\u021b\u0103 \u0219i disponibilitate ridicat\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>siste<\/span>me <\/span>redundan<\/span>te <\/span>sau <\/span>mecanisme <\/span>de <\/span>failover <\/span>pentru\n<\/span>asigurarea <\/span>protec\u021biei\ncontinue. <\/span>Evitarea <\/span>punctelor\n<\/span>unice <\/span>de <\/span>e\u0219ec, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>mediile <\/span>OT\n\u00een <\/span>care <\/span>timpul <\/span>de func\u021bionare <\/span>este <\/span>critic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estare \u0219i mentenan\u021b\u0103 periodic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mecanismele <\/span>de <\/span>failover <\/span>\u0219i <\/span>configura\u021biile <\/span>sigure\n<\/span>\u00een <\/span>ca<\/span>z <\/span>de <\/span>defec\u021biune <\/span>ar <\/span>tr<\/span>ebui <\/span>testate <\/span>periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Mentenan\u021ba ar trebui s\u0103 asigure <\/span>men\u021binerea dispozitivelor \u00eentr<\/span>-o\nstare sigur\u0103 \u0219i func\u021bional\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integritatea <\/span>controlului <\/span>accesului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Listele <\/span>de <\/span>control\n<\/span>al <\/span>accesului <\/span>(ACL) <\/span>\u0219i <\/span>politicile <\/span>de <\/span>securitate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>r\u0103m\u00e2n\u0103 <\/span>prot<\/span>ejate <\/span>\u0219i nemodificate \u00een timpul defec\u021biunilor<\/span>, pentru men\u021binerea posturii de\nsecuritate a sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i alertele<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea  <\/span><\/span>\u0219i  <\/span><\/span>alertarea  <\/span><\/span>\u00een  <\/span><\/span>timp  <\/span><\/span>real  <\/span><\/span>ar  <\/span><\/span>trebui\n <\/span><\/span>implementate\n <\/span><\/span>pentru\n <\/span><\/span>detec\u021bia\n <\/span><\/span>rapid\u0103\n <\/span><\/span>a\ndefec\u021biunilor \u0219i ini\u021bierea ac<\/span>\u021biunilor\ncorective.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Segmentarea \u0219i izolarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Proiectarea <\/span>re\u021belei <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>segmentare<\/span>a <\/span>\u0219i <\/span>izolarea\n<\/span>pentru <\/span>limitarea <\/span>impactului <\/span>unei defec\u021biuni \u0219i pentru prev<\/span>enirea\nefectelor \u00een cascad\u0103 asupra sistemelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceste <\/span>practici\n<\/span>sunt <\/span>aliniate <\/span>cu <\/span>standarde<\/span>le <\/span>recun<\/span>oscute,\n<\/span>inclusiv <\/span>NIST <\/span>SP <\/span>800<\/span>-53 <\/span>Rev<\/span>. <\/span>5, <\/span>NIST <\/span>SP<\/span><\/p>\n\n

 <\/span><\/p>\n\n

800-53A <\/span>\u0219i <\/span>IEC <\/span>62443-3-3 <\/span>SR <\/span>5.2 <\/span>RE <\/span>3 <\/span>– <\/span>Fail <\/span>Close,\n<\/span>care <\/span>pun <\/span>accentul\n<\/span>pe <\/span>siguran\u021ba <\/span>\u00een <\/span>caz <\/span>de defec\u021biune \u0219i rezilien\u021ba sistemelor <\/span>de infrastructur\u0103 critic\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.7<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\nasigure c\u0103 <\/span>mediile de dezvoltare \u0219i\ntestare sunt strict separate de mediul de produc\u021bie, <\/span>\u00een <\/span>special <\/span>\u00een <\/span>sistemele <\/span>ICS\/OT,\n<\/span>unde <\/span>orice <\/span>\u00eencruci\u0219are <\/span>ar <\/span>putea <\/span>compromite <\/span>siguran\u021ba, <\/span>pune \u00een\npericol s\u0103n\u0103tatea sau perturba opera\u021biunile esen\u021biale.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a preveni \u00eentreruperile neinten\u021bionate, riscurile de siguran\u021b\u0103\nsau \u00eenc\u0103lc\u0103rile <\/span>de <\/span>securitate, <\/span>asigur\u00e2<\/span>nd <\/span>c\u0103 <\/span>activit\u0103\u021bile <\/span>de <\/span>dezvoltare <\/span>\u0219i testare <\/span>nu <\/span>interfereaz\u0103 <\/span>cu <\/span>sistemele\nopera\u021bionale <\/span>active.<\/span><\/p>\n\n

\u00cen <\/span>mediile <\/span>OT, <\/span>precum <\/span>ICS, <\/span>chiar <\/span>\u0219i\ncele <\/span>mai <\/span>mici <\/span>interferen\u021be <\/span>\u00eentre testa<\/span>re <\/span>\u0219i <\/span>produc\u021bie\n<\/span>pot <\/span>conduce la condi\u021bii\nnesigure, \u00eentreruperi ale proceselor sau expunerea configura\u021biilor sensibile.\nSepararea strict\u0103 <\/span>contribuie <\/span>la <\/span>men\u021binerea <\/span>integrit\u0103\u021bii <\/span>sistemului, <\/span>sprijin\u0103 <\/span>controlul <\/span>modific\u0103rilor <\/span>\u0219i <\/span>reduce\n<\/span>riscul de ac\u021biuni accidentale sau r\u0103u inten\u021bionate care afecteaz\u0103\nopera\u021biunile critice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Separarea strict\u0103 a medii<\/span>lor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Activit\u0103\u021bile <\/span>de <\/span>dezvoltare <\/span>\u0219i <\/span>testare <\/span>ar <\/span>trebui <\/span>desf\u0103\u0219urate <\/span>\u00een <\/span>medii <\/span>separate\n<\/span>fizic <\/span>sau <\/span>logic <\/span>de\nmediul <\/span>de <\/span>produc\u021bie. Aceasta <\/span>este <\/span>deosebit\n<\/span>de <\/span>critic\u0103 <\/span>\u00een <\/span>mediile <\/span>ICS\/O<\/span>T<\/span>, <\/span>unde <\/span>siguran\u021ba\n<\/span>\u0219i fiabilitatea opera\u021bional\u0103 <\/span>nu\ntrebuie compromise.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea \u00eenainte de punerea \u00een func\u021biune<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Orice <\/span>modificare <\/span>destinat\u0103 <\/span>mediului <\/span>TIC <\/span>sau <\/span>OT <\/span>ar <\/span>trebui <\/span>testat\u0103\n<\/span>mai <\/span>\u00eent\u00e2i <\/span>\u00eentr<\/span>-un <\/span>mediu\n<\/span>care nu <\/span>este <\/span>de <\/span>produc\u021bie. <\/span>Aceasta\n<\/span>permit<\/span>e <\/span>evaluarea\n<\/span>impactului <\/span>poten\u021bial <\/span>\u0219i <\/span>a <\/span>ajust\u0103rilor <\/span>necesare \u00eenainte de punerea \u00een func\u021biune.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Medii de testare realiste<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Mediile <\/span>de <\/span>testare\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>reproduc\u0103 <\/span>c\u00e2t <\/span>mai <\/span>fidel\n<\/span>mediul <\/span>de <\/span>produc\u021bie <\/span>\u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te\nconfigura\u021bia, arhitectura \u0219i fluxul de date, pentru a asigura rezultate precise\nale test\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Practici de dezvoltare sigure<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Func\u021bionalit\u0103\u021bile <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>ar <\/span>trebui\n<\/span>int<\/span>egrate <\/span>\u0219i <\/span>testate <\/span>c\u00e2t <\/span>mai <\/span>devreme\n<\/span>posibil \u00een ciclul de via\u021b\u0103 al dezvolt\u0103rii, respect\u00e2nd principiile SDLC.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.8<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\ndefineasc\u0103, monitorizeze \u0219i controleze fluxul de informa\u021bii \u0219i date \u00een cadrul\n\u0219i \u00eentre sistemele sal<\/span>e critice pentru\na asigura c\u0103 au loc numai schimburi autorizate \u0219i sigure, indiferent de\ngrani\u021bele re\u021belei sau de <\/span>arhitectura\nsistemului.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceast\u0103 <\/span>cerin\u021b\u0103 <\/span>se <\/span>bazeaz\u0103\n<\/span>pe <\/span>PR.IR-01.3 <\/span>(controlul <\/span>conexiunilor <\/span>sistemului) <\/span>\u0219i <\/span>PR.IR<\/span>-01.4 <\/span>(protec\u021bia\ngrani\u021belor), <\/span>dar <\/span>merge\n<\/span>mai <\/span>departe, <\/span>concentr\u00e2ndu-se <\/span>pe <\/span>ce <\/span>date <\/span>pot <\/span>fi <\/span>transferate, <\/span>unde <\/span>\u0219i <\/span>\u00een <\/span>ce <\/span>condi\u021bii<\/span><\/p>\n\n

– nu doar pe modul \u00een care sistemele sunt conectate\nsau segme<\/span>ntate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

De\n<\/span>asemenea, <\/span>aceasta <\/span>completeaz\u0103 <\/span>C<\/span>ontrolul <\/span>ID.AM<\/span>-03.2, <\/span>care <\/span>prevede <\/span>identific<\/span>area, <\/span>documentarea, autorizarea <\/span>\u0219i <\/span>actualizarea <\/span>comunica\u021biilor <\/span>de <\/span>re\u021bea <\/span>\u0219i <\/span>a <\/span>fluxurilor <\/span>interne <\/span>de <\/span>date. <\/span>Controlul <\/span>PR.IR<\/span>–<\/span><\/p>\n\n

01.8\n<\/span>asigur\u0103 <\/span>c\u0103 <\/span>aceste\n<\/span>flu<\/span>xuri <\/span>docume<\/span>ntate <\/span>sunt,\n<\/span>de <\/span>asemenea, <\/span>puse <\/span>\u00een <\/span>aplicare\n<\/span>\u0219i <\/span>monitorizate <\/span>\u00een <\/span>mod\nactiv.<\/span><\/p>\n\n

Controlul <\/span>fluxurilor <\/span>de <\/span>informa\u021bii <\/span>\u0219i <\/span>date <\/span>este <\/span>deosebit <\/span>de <\/span>critic <\/span>\u00een <\/span>mediile <\/span>ICS\/OT,\n<\/span>unde <\/span>orice <\/span>schimb neautorizat <\/span>sau <\/span>neinten\u021bionat <\/span>de <\/span>date\npoate <\/span>compromite <\/span>s\u0103n\u0103tatea, <\/span>siguran\u021ba <\/span>\u0219i <\/span>protec\u021bia\n<\/span>mediului <\/span>\u0219i, prin urmare,\ntrebuie strict reglementat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiec<\/span>tiv<\/span>,\nar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea \u0219i punerea \u00een aplicare a politicilor de\ncontrol al fluxurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>utilizate\n<\/span>instrumente <\/span>\u0219i <\/span>politici <\/span>pentru <\/span>a <\/span>controla <\/span>modul <\/span>\u00een <\/span>care <\/span>datele <\/span>circul\u0103 <\/span>\u00eentre\nsisteme \u0219i \u00een diferite p\u0103r\u021bi ale re\u021bel<\/span>ei, <\/span>asigur\u00e2nd c\u0103 au loc numai fluxuri\nautorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Criptarea datelor \u00een tranzit \u0219i \u00een repaus<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>protocoalelor <\/span>de <\/span>criptare <\/span>sigure,\n<\/span>precu<\/span>m <\/span>TLS\/SSL <\/span>pentru <\/span>datele <\/span>\u00een <\/span>tranzit\n<\/span>\u0219i <\/span>AES<\/span>–<\/span><\/p>\n\n

 <\/span><\/p>\n\n

256\npentru datele stocate, pentru protejarea confiden\u021bialit\u0103\u021bii \u0219i integrit\u0103\u021bii<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea MF<\/span>A<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>MF<\/span>A <\/span>ar <\/span>trebui <\/span>implementat <\/span>pentru <\/span>verificarea <\/span>identit\u0103\u021bii <\/span>utilizatorilor <\/span>care <\/span>acceseaz\u0103\n<\/span>sisteme care gestioneaz\u0103 sau transmit date sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>API-uri sigure<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>API-urile  <\/span><\/span>utilizate  <\/span><\/span>pentru  <\/span><\/span>comunicarea\n <\/span><\/span>\u00eentre\n <\/span><\/span>sisteme\n <\/span><\/span>ar\n <\/span><\/span>tr<\/span>ebui  <\/span><\/span>s\u0103  <\/span><\/span>res<\/span>pecte\n <\/span><\/span>practicile\n <\/span><\/span>de\ndezvoltare securizate \u0219i s\u0103 fie revizuite periodic pentru identificarea\nvulnerabilit\u0103\u021bilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea monitoriz\u0103rii continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>de <\/span>monitorizare <\/span>\u00een <\/span>timp <\/span>real <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>detectez<\/span>e <\/span>flux<\/span>urile <\/span>de <\/span>date <\/span>neautorizate sau anomaliile, \u00eenso\u021bite de\nmecanisme de alertare care s\u0103 <\/span>permit\u0103\ninterven\u021bia imediat\u0103 \u0219i gestionarea prompt\u0103 a incidentelor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Efectuarea de audituri periodice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Auditurile <\/span>periodice <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>verifice <\/span>conformitatea <\/span>cu <\/span>politicile <\/span>priv<\/span>ind <\/span>flux<\/span>ul <\/span>de <\/span>date <\/span>\u0219i s\u0103 identifice poten\u021bialele puncte slabe\nsau modific\u0103rile neautorizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Aplicarea segment\u0103rii re\u021belei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Segmentarea <\/span>re\u021belei <\/span>pentru <\/span>restric\u021bionarea <\/span>fluxurilor <\/span>de <\/span>date <\/span>inutile\n<\/span>\u0219i <\/span>limitarea <\/span>im<\/span>pactului\npoten\u021bialelor <\/span>\u00eenc\u0103lc\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Securizarea accesului la <\/span>distan\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>VPN-urile <\/span>ar <\/span>trebui <\/span>utili<\/span>zate <\/span>pentru <\/span>conectarea\n<\/span>\u00een <\/span>mod <\/span>securizat <\/span>a <\/span>sistemelor\n<\/span>\u0219i <\/span>utilizatorilor la distan\u021b\u0103\nla re\u021beaua or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea DLP<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Solu\u021biile <\/span>DLP <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>monitorizeze <\/span>\u0219i <\/span>s\u0103 <\/span>controleze\n<\/span>transferul <\/span>de <\/span>informa\u021bii\n<\/span>sensibile, <\/span>\u00een special atunci\nc\u00e2nd p\u0103r\u0103sesc or<\/span>ganiza\u021bia.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea personalului \u0219i con\u0219tientizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Angaja\u021bii <\/span>ar <\/span>trebui\n<\/span>instrui\u021bi <\/span>cu <\/span>privire\n<\/span>la <\/span>politicile <\/span>de <\/span>gestionare <\/span>a <\/span>datelor <\/span>\u0219i <\/span>la <\/span>imp<\/span>ortan\u021ba\ncontrolului fluxurilor de informa\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Simularea atacurilor de phishing<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>efectuate\n<\/span>simul\u0103ri <\/span>regulate <\/span>de <\/span>phishing <\/span>pentru <\/span>reducerea <\/span>riscului\n<\/span>de <\/span>atacuri <\/span>de inginerie social\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-01.9<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>gestioneze <\/span>interfe\u021bele <\/span>cu <\/span>serviciile <\/span>externe <\/span>de <\/span>telecomunica\u021bii <\/span>ca <\/span>parte <\/span>a <\/span>politicii\nsale mai ample de securitat<\/span>e a\nre\u021belei, definind modul \u00een care este controlat traficul, asigur\u00e2nd\nconfiden\u021bialitatea <\/span>\u0219i <\/span>integritatea <\/span>informa\u021biilor <\/span>transmise <\/span>\u0219i <\/span>revizuind <\/span>\u0219i <\/span>document\u00e2nd <\/span>orice\n<\/span>excep\u021bii <\/span>de la regulile\nstabilite.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest Control se bazeaz\u0103 pe PR.IR<\/span>-01.8, concentr\u00e2ndu-se \u00een mod specific pe\nmodul \u00een care comunica\u021biile <\/span>externe <\/span>sunt <\/span>reglementate <\/span>\u00een <\/span>cadrul <\/span>poli<\/span>ticii <\/span>de <\/span>securitate <\/span>a <\/span>re\u021belei <\/span>organiza\u021biei. <\/span>\u00cen t<\/span>imp ce <\/span>configura<\/span>\u021biile\nfirewall-ului <\/span>\u0219i <\/span>set\u0103rile\n<\/span>de <\/span>securitate <\/span>de <\/span>baz\u0103 <\/span>asigur\u0103\n<\/span>punerea <\/span>\u00een <\/span>aplicare\n<\/span>teh<\/span>nic\u0103, aceast\u0103 cerin\u021b\u0103 pune\naccentul pe politica \u0219i nivelul de supraveghere.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea gestion\u0103rii fluxului de trafic \u00een politica\nde securitate a re\u021belei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politica <\/span>de <\/span>securitate <\/span>a <\/span>re\u021belei <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>reguli <\/span>clare <\/span>privind\n<\/span>modul <\/span>\u00een <\/span>care <\/span>traficul\nde date \u0219i voce poate circula \u00eentre sistemele intern<\/span>e \u0219i serviciile de telecomunica\u021bii externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea obiectivelor \u0219i a domeniului de aplicare al\nsecurit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Politica <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>prezinte <\/span>obiectivele <\/span>de <\/span>protejare <\/span>a <\/span>comunica\u021biilor <\/span>exte<\/span>rne <\/span>\u0219i <\/span>s\u0103 <\/span>specifice sistemele \u0219i serviciile\nacoperite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controlul \u0219i monitorizarea traficului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>raficul <\/span>de <\/span>re\u021bea <\/span>ar <\/span>trebui <\/span>monitoriza<\/span>t <\/span>continuu <\/span>pentru <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>respect\u0103 <\/span>regulile\n<\/span>definite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Fluxurile\nsuspecte sau neautorizate ar trebui s\u0103 declan\u0219eze alerte \u0219i s\u0103 fie investigate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea datelor \u00een tranzit<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Confiden\u021bialitatea <\/span>\u0219i <\/span>integritatea <\/span>datelor <\/span>transmise <\/span>ar <\/span>trebui <\/span>protejate\n<\/span>utiliz\u00e2nd <\/span>protocoale <\/span>de criptare, precum <\/span>TLS\/SSL.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i revizuirea excep\u021biilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Orice <\/span>excep\u021bii <\/span>de <\/span>la <\/span>regulile\n<\/span>privind <\/span>fluxul <\/span>de <\/span>trafic <\/span>(de <\/span>exemplu, <\/span>accesul\n<\/span>temporar <\/span>al <\/span>unei p\u0103r\u021bi ter\u021be) ar trebui documentate\n\u00een mod formal, justificate \u0219i revizuite periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>R\u0103spunsul la incidente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganiza\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>preg\u0103tit\u0103 <\/span>s\u0103 <\/span>izoleze <\/span>\u0219i <\/span>s\u0103 <\/span>r\u0103spund\u0103\n<\/span>rapid <\/span>la <\/span>tiparele\n<\/span>de <\/span>trafic anormale sau cu\nscop nelegitim.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea alinierii politicilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Componenta <\/span>fluxului <\/span>de <\/span>trafic <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>aliniat\u0103\n<\/span>cu <\/span>alte <\/span>ele<\/span>mente <\/span>ale <\/span>politicii <\/span>de <\/span>securitate\na <\/span>re\u021belei, <\/span>inclusiv <\/span>controlul <\/span>accesului, <\/span>utilizarea <\/span>VPN, <\/span>managementul <\/span>patch<\/span>-urilor <\/span>\u0219i <\/span>r\u0103spunsul\nla incidente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activele tehnologice ale organiza\u021biei sunt protejate \u00eem<\/span>potriva amenin\u021b\u0103rilor de mediu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie <\/span>s\u0103 <\/span>defineasc\u0103, <\/span>implem<\/span>enteze <\/span>\u0219i <\/span>men\u021bin\u0103 <\/span>politic<\/span>i <\/span>\u0219i <\/span>proceduri <\/span>legate <\/span>de <\/span>sistemele de urgen\u021b\u0103 \u0219i siguran\u021b\u0103,\nsistemele de protec\u021bie \u00eempotriva incendiilor \u0219i controalele de mediu pentru\nsistemele sale critice.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nproteja siste<\/span>mele critice \u00eempotriva\nriscurilor de mediu \u0219i a situa\u021biilor de <\/span>urgen\u021b\u0103\ncare ar putea perturba opera\u021biunile, deteriora echipamentele sau pune \u00een\npericol siguran\u021ba <\/span>– \u00een special \u00een\nmediile OT, unde condi\u021biile fizice au un impact direct asupra disponibilit\u0103\u021bii\nsistemului \u0219i siguran\u021bei umane.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Efectuarea evalu\u0103rilor riscurilor\npentru toate loca\u021biile care g\u0103zduiesc sisteme criti<\/span>ce, pentru identificarea riscurilor de mediu \u0219i de ur<\/span>g<\/span>en\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Definirea <\/span>politicilor <\/span>\u0219i <\/span>procedurilor <\/span>pentru <\/span>protec\u021bia <\/span>\u00eempotriva\n<\/span>incendiilor<\/span>, <\/span>r\u0103spunsul\n<\/span>la <\/span>situa\u021bii <\/span>de ur<\/span>gen\u021b\u0103\n\u0219i controalele de mediu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instalarea <\/span>unor <\/span>sisteme <\/span>de <\/span>monitoriza<\/span>re, <\/span>precum <\/span>senzori\n<\/span>de <\/span>temperatur\u0103, <\/span>umiditate, <\/span>fum <\/span>\u0219i <\/span>scur<\/span>geri\nde ap\u0103, cu alerte pentru condi\u021bii anormale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea <\/span>m\u0103surilor <\/span>de <\/span>protec\u021bie <\/span>\u00eempotriva <\/span>incendiilor<\/span>, <\/span>inclus<\/span>iv <\/span>sisteme\n<\/span>adecvate <\/span>de <\/span>stingere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(de\nexemplu, pe baz\u0103 de gaz pentru centrele de date), alarme, detectoare \u0219i\nsting\u0103toare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Inspectarea <\/span>\u0219i <\/span>men\u021binerea <\/span>regulat\u0103 <\/span>a <\/span>sis<\/span>temelor <\/span>de <\/span>siguran\u021b\u0103 <\/span>\u00eempotriva\n<\/span>incendiilor <\/span>\u0219i <\/span>de <\/span>protec\u021bie\na mediului, inclusiv sistemele de \u00eenc\u0103lzire, ventila\u021bie \u0219i climatizare (HV<\/span>AC) \u0219i ilu<\/span>minatul de ur<\/span>gen\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Includerea <\/span>cerin\u021belor <\/span>de <\/span>protec\u021bie\n<\/span>a <\/span>mediului <\/span>\u00een <\/span>contractele <\/span>cu <\/span>p\u0103r\u021bi <\/span>ter\u021be <\/span>\u0219i <\/span>solicitarea <\/span>un<\/span>or <\/span>dovezi de conformitate \u0219i mentenan\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instruirea <\/span>personalului <\/span>cu <\/span>privire\n<\/span>la <\/span>procedurile <\/span>de <\/span>ur<\/span>gen\u021b\u0103 <\/span>\u0219i <\/span>or<\/span>ganizarea <\/span>de <\/span>exerci\u021bii <\/span>de <\/span>evacuare\n\u0219i interven\u021bie \u00een caz de incendiu cel pu\u021bin anual.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>implementeze dispozitive <\/span>de <\/span>detec\u021bie <\/span>a <\/span>incendii<\/span>lor <\/span>care <\/span>se <\/span>activeaz\u0103 <\/span>\u0219i <\/span>notific\u0103\nautomat personalul cheie \u00een cazul unui incendiu.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nasigura <\/span>detec\u021bia <\/span>timpurie\n<\/span>a <\/span>incidentelor <\/span>de incendiu <\/span>\u0219i <\/span>alertarea automat\u0103\na pers<\/span>onalului cheie, pentru a permite\no reac\u021bie rapid\u0103 \u0219i coordonat\u0103, \u00een special \u00een medii \u00een care sistemele critice\nsus\u021bin siguran\u021ba sau opera\u021biunile esen\u021biale.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Implementarea <\/span>unor <\/span>sisteme <\/span>automate <\/span>de <\/span>detec\u021bie <\/span>a <\/span>incendiilor <\/span>care <\/span>utilizeaz\u0103 <\/span>detectoare\n<\/span>de <\/span>fum \u0219i c\u0103ldur\u0103 \u0219i se\nactiveaz\u0103 f\u0103r<\/span>\u0103 interven\u021bie manual\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Integrarea <\/span>detec\u021biei <\/span>incendiilor <\/span>cu <\/span>sisteme <\/span>automate\n<\/span>de <\/span>stingere, <\/span>acolo\n<\/span>unde <\/span>este <\/span>cazul\n<\/span>(de exemplu, sprinklere sau sisteme <\/span>pe\nbaz\u0103 de gaz).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Configurare<\/span>a <\/span>sistemelor <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>notifice <\/span>automat\n<\/span>personalul <\/span>desemnat <\/span>sau <\/span>echipele <\/span>de interven\u021bie \u00een caz de ur<\/span>gen\u021b\u0103 la activare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Definirea <\/span>\u0219i <\/span>men\u021binerea <\/span>unei <\/span>liste <\/span>de <\/span>notific\u0103ri <\/span>cu <\/span>roluri <\/span>atribuite <\/span>clar<\/span>, <\/span>asigur\u00e2nd <\/span>c\u0103 <\/span>persoanele fizice\nau accesul \u0219i autoriza\u021bia necesare, \u00een special \u00een medii sensibile sau\nclasificate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Mecanismele pentru \u00eendeplinirea\ncerin\u021belor de rezilien\u021b\u0103 \u00een situa\u021bii normale \u0219i adverse sunt implementate.<\/span><\/p>\n\n

PR.IR-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103 imp<\/span>lementeze mecanisme pentru a asigura c\u0103\nsistemele \u0219i serviciile critice r\u0103m\u00e2n <\/span>opera\u021bionale <\/span>sau <\/span>pot <\/span>fi <\/span>repuse <\/span>rapid <\/span>\u00een <\/span>func\u021biune\n<\/span>at\u00e2t \u00een <\/span>condi\u021bii <\/span>normale\n<\/span>de <\/span>func\u021bionare, <\/span>c\u00e2t <\/span>\u0219i\n\u00een condi\u021bii adverse.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a a<\/span>sigura\nc\u0103 <\/span>sistemele <\/span>\u0219i <\/span>serviciile <\/span>critice <\/span>r\u0103m\u00e2n <\/span>opera\u021bionale sau pot fi repus<\/span>e rapid \u00een func\u021biune, at\u00e2t \u00een condi\u021bii\nnormale de func\u021bionare, c\u00e2t \u0219i \u00een condi\u021bii adverse, precum atacuri cibernetice,\ndefec\u021biuni hardware sau dezastre naturale.<\/span><\/p>\n\n

Acest <\/span>Control\n<\/span>sus\u021bine <\/span>obiectivul <\/span>mai <\/span>larg <\/span>al <\/span>rezilien\u021bei <\/span>opera\u021bionale. <\/span>\u00cen <\/span>timp <\/span>ce <\/span>redundan\u021ba <\/span>(astfel\n<\/span>cum este abordat\u0103 \u00een GV.OC-04.3) con<\/span>tribuie\nla prevenirea \u00eentreruperilor prin duplicarea componentelor<\/span>, rezilien\u021ba <\/span>asigur\u0103 <\/span>c\u0103 <\/span>opera\u021biunile <\/span>pot <\/span>continua <\/span>sau <\/span>pot <\/span>fi restabili<\/span>te <\/span>rapid <\/span>chiar <\/span>\u0219i <\/span>atunci <\/span>c\u00e2nd <\/span>apar defec\u021biuni. Ambele sunt esen\u021biale pe<\/span>ntru men\u021binerea disponibilit\u0103\u021bii \u00een medii\nIT \u0219i OT complexe.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea obiectivelor de rezilien\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea\nsistemelor critice \u0219i definirea valorilor acceptabile ale R<\/span>T<\/span>O\n\u0219i RPO.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Alinierea\nobiectivelor de rezilien\u021b\u0103 cu BCP <\/span>\u0219i\nDRP<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Proiectarea pentru rezilien\u021b\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Implementarea <\/span>arhitecturilor <\/span>tolerante\n<\/span>la <\/span>erori <\/span>(de <\/span>exemplu, <\/span>clustering, <\/span>echilibrarea <\/span>sarcini<\/span>i, redundan\u021ba <\/span>geografic\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>diverselor <\/span>tehnologii <\/span>\u0219i <\/span>furnizori\n<\/span>pentru <\/span>reducerea <\/span>dependen\u021bei <\/span>de <\/span>puncte <\/span>unice <\/span>de\ne\u0219ec.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea <\/span>preg\u0103tirii <\/span>opera\u021bionale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>estarea regulat\u0103\na sistemelor de failover prin simul\u0103ri \u0219i comut\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Men\u021binerea\nprocedurilor <\/span>opera\u021bionale \u0219i instru<\/span>c\u021biunilor de recuperare actualizate \u0219i\nexacte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Consolidare<\/span>a\nrezilien\u021bei cibernetice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Integrarea  <\/span><\/span>strategiilor  <\/span><\/span>de  <\/span><\/span>rezilien\u021b\u0103  <\/span><\/span>\u00een  <\/span><\/span>IRP<\/span>-uri  <\/span><\/span>(de  <\/span><\/span>exemplu,  <\/span><\/span>limitarea  <\/span><\/span>ransomware<\/span>-ului, restaurarea <\/span>datelor).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea  <\/span><\/span>backup-urilor  <\/span><\/span>imuabile  <\/span><\/span>\u0219i  <\/span><\/span>segmentarea\n <\/span><\/span>re\u021belei\n <\/span><\/span>pentru\n <\/span><\/span>limitarea\n <\/span><\/span>im<\/span>pactului incidentelor <\/span>cibernetice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea rezilien\u021bei p\u0103r\u021bilor ter\u021be<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluarea\nrezilien\u021bei furnizorilor de <\/span>servicii\ncritice \u0219i documentarea concluziilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Includerea\ncerin\u021belor de rezilien\u021b\u0103 \u0219i recuperar<\/span>e\n\u00een SLA-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Promovarea \u00eembun\u0103t\u0103\u021birii continue<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirea\n\u0219i actualizarea mecanismelor de rezilien\u021b\u0103 dup\u0103 incidente sau modific\u0103ri\nmajore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cencorporarea <\/span>lec\u021biilor \u00eenv\u0103\u021bate \u00een plan<\/span>ificarea \u0219i testarea viitoare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

PR.IR-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Capacitatea adecvat\u0103 a resurselor p<\/span>e<\/span>ntru\nasigurarea disponibilit\u0103\u021bii este men\u021binut\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

PR.IR-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Planificarea adecvat\u0103 a capacit\u0103\u021bii\nres<\/span>urselor trebuie s\u0103 asigure\nmen\u021binerea disponibilit\u0103\u021bii sistemelo<\/span>r\ncritice ale organiza\u021biei pentru procesarea informa\u021biilor, re\u021belele, <\/span>telecomunica\u021biile \u0219i stocarea datelor.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 sistemele critice dispun \u00een permanen\u021b\u0103 de\nsuficiente resurse de calcul, stocare \u0219i re\u021bea, prin planificarea \u00een avans a\nnecesit\u0103\u021bilor actuale \u0219i viit<\/span>oare de\ncapacitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Previzionare \u0219i planificare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Nevoile <\/span>de <\/span>resurse\n<\/span>ar <\/span>trebui <\/span>previzionate <\/span>periodic, <\/span>pe <\/span>baza <\/span>cre\u0219terii <\/span>or<\/span>ganiza\u021biei, <\/span>a <\/span>ti<\/span>parelor sezoniere <\/span>\u0219i <\/span>a <\/span>tendin\u021belor <\/span>de <\/span>utilizare. <\/span>Cererea\n<\/span>viitoare <\/span>de <\/span>capacitate <\/span>de <\/span>calcul, <\/span>stocare\n<\/span>\u0219i <\/span>re\u021bea trebuie anticipat\u0103\npentru prevenirea problemelor de performan\u021b\u0103 sau \u00eentre<\/span>ruperilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Luarea \u00een co<\/span>nsiderare\na termenelor de aprovizionare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planificarea <\/span>capacit\u0103\u021bii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>considere <\/span>poten\u021bialele <\/span>\u00eent\u00e2rzieri <\/span>\u00een <\/span>livrarea\n<\/span>hardw<\/span>are<\/span>-ului sau <\/span>a <\/span>serviciilor <\/span>din <\/span>cauza <\/span>perturb\u0103rilor <\/span>lan\u021bului <\/span>de <\/span>aprovizionare <\/span>sau <\/span>a <\/span>celor <\/span>geopolitice. <\/span>Ar trebui men\u021binut\u0103 o capac<\/span>itate tampon pentru a absorbi cererea\nnea\u0219teptat\u0103 sau \u00eent\u00e2rzierile de expansiune.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i stabilirea pragurilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>ar <\/span>trebui <\/span>monitorizate <\/span>continuu <\/span>pentru <\/span>urm\u0103rirea\n<\/span>utiliz\u0103rii. <\/span>Pragurile <\/span>\u0219i <\/span>alertele <\/span>ar trebui\n<\/span>configurate <\/span>pentru <\/span>declan\u0219area <\/span>ac\u021biunilor <\/span>de <\/span>scalare\n<\/span>\u00een <\/span>timp <\/span>util, <\/span>\u00eenainte <\/span>ca <\/span>performan\u021ba\ns\u0103 fie afectat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea componentelor cu disponibilitate ridicat\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Componentele <\/span>redundante <\/span>(de <\/span>exemplu, <\/span>matrice\n<\/span>RAID, <\/span>interfe\u021be <\/span>de <\/span>re\u021bea <\/span>duale,\n<\/span>surse <\/span>de alimentare <\/span>de <\/span>rezerv\u0103) <\/span>ar <\/span>trebui <\/span>imp<\/span>lementate <\/span>pentru reducerea <\/span>timpului <\/span>de <\/span>nefunc\u021bionare cauzat <\/span>de <\/span>defec\u021biuni <\/span>hardware. <\/span>Acestea <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>completeze, <\/span>nu <\/span>s\u0103 <\/span>\u00eenlocuiasc\u0103, <\/span>planificarea capacit\u0103\u021bii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i ajustarea periodic\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planurile <\/span>de <\/span>capacitate <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>periodic <\/span>\u0219i <\/span>actualizate <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>modific\u0103rile <\/span>\u00een strategia or<\/span>ganiza\u021biei, tehnologie sau factori <\/span>externi de risc.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DETEC\u021aIE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

[DE.CM] MONITORIZARE CONTINU\u0102<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activele <\/span>sunt <\/span>monitoriza<\/span>te <\/span>pentru <\/span>identificarea <\/span>anomaliilor, <\/span>indicatorilor <\/span>de <\/span>compromitere <\/span>(IoC) <\/span>\u0219i\nalte evenimente poten\u021bial adverse.<\/span><\/p>\n\n

DE.CM-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Re\u021belele\n\u0219i serviciile de re\u021bea sunt monit<\/span>orizate\npent<\/span>ru identificarea evenimentelor\npoten\u021bial adverse.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Firewall-urile <\/span>trebuie <\/span>instalate <\/span>\u0219i <\/span>operate <\/span>la <\/span>grani\u021bele <\/span>re\u021belei,\n<\/span>inclusiv <\/span>firewall<\/span>-urile\n<\/span>la <\/span>nivel <\/span>de endpoint.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>\u00eembun\u0103t\u0103\u021bi <\/span>vizibilitatea <\/span>\u0219i <\/span>detec\u021bia <\/span>amenin\u021b\u0103rilor <\/span>la <\/span>nivel <\/span>de dispozitiv, \u00een special a celor care pot\nocoli sistemele tradi\u021bionale de ap\u0103rare a perimetrului re\u021belei. Acest  <\/span><\/span>Control\n <\/span><\/span>se\n <\/span><\/span>concentreaz\u0103\n <\/span><\/span>pe\n <\/span><\/span>utilizarea\n <\/span><\/span>firewall<\/span>-urilor  <\/span><\/span>la  <\/span><\/span>nivel  <\/span><\/span>de  <\/span><\/span>host  <\/span><\/span>pentru  <\/span><\/span>detec\u021bia amenin\u021b\u0103rilor <\/span>care <\/span>pot <\/span>ocoli <\/span>perimetr<\/span>ul <\/span>re\u021belei, <\/span>prin <\/span>monitorizarea <\/span>\u0219i c<\/span>ontrolul <\/span>traficului <\/span>c\u0103tre <\/span>\u0219i <\/span>de <\/span>la\ndispozitive <\/span>individuale <\/span>(accent:\n<\/span>vizibilitate <\/span>\u0219i <\/span>detec\u021bie). <\/span>\u00cen <\/span>schimb, <\/span>Controlul\n<\/span>PR.IR<\/span>-01.1 <\/span>se <\/span>refer\u0103 <\/span>la firewall-urile <\/span>la <\/span>nivel <\/span>de <\/span>re\u021bea, <\/span>care <\/span>sunt <\/span>proiectate <\/span>pentru <\/span>pre<\/span>venirea <\/span>accesului <\/span>neautorizat <\/span>prin gestionarea traficului care intr\u0103 sau iese din re\u021bea\n(accent: control \u0219i preven\u021bie).<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea endpoint<\/span>-urilor\n\u00een sens lar<\/span>g<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>incluse <\/span>desktop-uri, <\/span>laptop-uri, <\/span>servere, <\/span>smartphone-uri <\/span>\u0219i, <\/span>acolo <\/span>unde <\/span>este <\/span>fezabil, componente OT <\/span>precum PLC-uri \u0219i HMI<\/span>-uri, precum \u0219i dispozitive IoT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea firewall<\/span>-urilor\nla nivel de host<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea <\/span>instal\u0103rii, <\/span>activ\u0103rii\n<\/span>\u0219i <\/span>configur\u0103rii <\/span>corespunz<\/span>\u0103toare <\/span>a <\/span>mecanismelor <\/span>de <\/span>tip <\/span>fi<\/span>rewall\nla <\/span>nivelul <\/span>tuturor <\/span>dispozitivelor <\/span>endpoint. <\/span>Aceste <\/span>fi<\/span>rewall-uri <\/span>contribuie <\/span>la <\/span>detec\u021bia\n<\/span>\u0219i <\/span>blocarea activit\u0103\u021bilor\nsuspecte <\/span>direct <\/span>la <\/span>nivelul <\/span>dispozitivului, <\/span>chiar <\/span>\u0219i <\/span>atunci <\/span>c\u00e2nd <\/span>acesta <\/span>este <\/span>conecta<\/span>t\nla re\u021bele securizate <\/span>sau <\/span>VPN-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Segmentarea activelor de re\u021bea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Gruparea <\/span>sistemelor <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>criticitatea <\/span>sau <\/span>func\u021bia <\/span>lor <\/span>(de <\/span>exemplu, <\/span>plasarea <\/span>serviciilor publice, precum serverele de\ne-mail, web \u0219i <\/span>VPN, \u00eentr<\/span>-o zon\u0103 DMZ).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea regulilor predefinite pentru <\/span>firewall<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea <\/span>unor <\/span>reguli <\/span>pentru <\/span>filtrarea\n<\/span>traficului <\/span>de <\/span>intrare\n<\/span>\u0219i <\/span>de <\/span>ie\u0219ire, <\/span>contribuind <\/span>astfel\n<\/span>la detec\u021bia anomaliilor sau a comportamentelor r\u0103u inten\u021bionate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Limitarea punctelor de acces de internet<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Reducerea <\/span>num\u0103rului <\/span>de <\/span>puncte <\/span>de <\/span>interconectar<\/span>e <\/span>la <\/span>int<\/span>ernet <\/span>pentru <\/span>minimizarea <\/span>expunerii\n<\/span>\u0219i simplificarea monitoriz\u0103<\/span>rii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Programele antivirus, antispyware \u0219i alte programe antimalware\ntrebuie instalate \u0219i actualizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 toate dispozitivele orga<\/span>niza\u021biei\n(active IT \u0219i OT) sunt protejate \u00eempotriva software<\/span>-ului cu scop nelegitim, prin implementarea \u0219i actualizarea\nperiodic\u0103 a instrumentelor antimalware.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een co<\/span>nsiderare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Domeniul de aplicare al protec\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitive <\/span>IT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Instalarea\nsoftware-ului antimalware pe toate dispozitivel<\/span>e\nutilizatorilor \u0219i ale sistemului, inclusiv desktop-uri, laptop-uri, servere,\nsmartphone-uri \u0219i tablete.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dispozitive <\/span>OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Extinderea\nprotec\u021biei la active OT<\/span>, precum PLC-u<\/span>ri, HMI-uri, servere SCADA <\/span>\u0219i sta\u021bii de lucru ale inginerilor<\/span>, acolo unde este fezabil din punct de\nvedere tehnic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Practici de a<\/span>ctualizare\n\u0219i scanare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>IT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Configurare<\/span>a <\/span>instrumentelor <\/span>antimalware <\/span>pentru <\/span>actualizare <\/span>\u00een <\/span>timp <\/span>real <\/span>sau <\/span>cel <\/span>pu\u021bin\nzilnic, urmat\u0103 de scan\u0103ri automate sau programate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Planificarea  <\/span>cu \n<\/span>aten\u021bie  <\/span>a  <\/span>actualiz\u0103rilor  <\/span>\u0219i \n<\/span>scan\u0103rilor  <\/span>pentru  <\/span>evitarea \n<\/span>\u00eentreruperii opera\u021bionale<\/span>. <\/span>Utilizarea <\/span>ferestrelor de <\/span>mentenan\u021b\u0103 <\/span>\u0219i <\/span>testarea <\/span>actualiz\u0103rilor <\/span>\u00eenainte <\/span>de punerea \u00een\nfunc\u021biune.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Solu\u021bii personalizate pentru OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>instrumentelor <\/span>antimalware <\/span>u\u0219oare <\/span>sau <\/span>specifice <\/span>OT<\/span>, <\/span>compatibile <\/span>cu <\/span>sistemele <\/span>\u00een timp\n<\/span>real.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru\ndispozitivele OT <\/span>vechi sau cu resurse\nlimitate, ar trebu<\/span>i luate \u00een\nconsiderare:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Lista\nalb\u0103 a aplica\u021biilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Detec\u021bia\nmalware-ului la nivel de re\u021bea.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Utilizarea\ninstrumentelor specializate care monitorizeaz\u0103 \u00een mod silen\u021bios sistemele\nindustriale <\/span>p<\/span>entru <\/span>detec\u021bia <\/span>activit\u0103\u021bilor <\/span>neobi\u0219nuite <\/span>sau <\/span>suspecte, <\/span>f\u0103r\u0103 <\/span>a <\/span>interfera <\/span>cu <\/span>modul de\nfunc\u021bionare al sistem<\/span>elor\n(monitorizare pasiv\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Munca la distan\u021b\u0103 \u0219i utilizarea dispozitivelor\nelectronice personale (BYOD)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aplicarea\nacelora\u0219i standarde de protec\u021bie pentru:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Calculatoarele\npersonale uti<\/span>lizate pentru telemunc\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Dispozitive\npersonale (BYOD) utilizate <\/span>pentru\nsarcini profesionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>platformelor <\/span>de <\/span>protec\u021bie <\/span>a <\/span>endpoint<\/span>-urilor <\/span>pentru <\/span>punerea\n<\/span>\u00een <\/span>aplicare <\/span>a <\/span>politicilor\npe toate dispozitivele.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Gestionare \u0219i monitorizare centraliza<\/span>te<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea  <\/span><\/span>unor  <\/span><\/span>instrumente  <\/span><\/span>centralizate  <\/span><\/span>pentru\n <\/span><\/span>a\n <\/span><\/span>gestiona\n <\/span><\/span>configura\u021biile,\n <\/span><\/span>actualiz\u0103rile\n <\/span><\/span>\u0219i\nalertele antimalware at\u00e2t \u00een mediile IT<\/span>,\nc\u00e2t \u0219i \u00een cele OT<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Integrarea <\/span>alertelor <\/span>malw<\/span>are <\/span>\u00een <\/span>procesele <\/span>mai <\/span>ample <\/span>de <\/span>monitorizare <\/span>a <\/span>securit\u0103\u021bii <\/span>\u0219i <\/span>de <\/span>r\u0103spuns la incidente ale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cembun\u0103t\u0103\u021birea continu\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirea\n\u0219i testarea periodic\u0103 a eficacit\u0103\u021bii solu\u021biilor antimalware.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Actualizarea  <\/span><\/span>politicilor  <\/span><\/span>\u0219i  <\/span><\/span>instr<\/span>umentelor  <\/span><\/span>pe  <\/span><\/span>baza  <\/span><\/span>amenin\u021b\u0103rilor  <\/span><\/span>emer<\/span>gente  <\/span><\/span>\u0219i  <\/span><\/span>a  <\/span><\/span>lec\u021biilor \u00eenv\u0103\u021bate din incidente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-01.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>monitorizeze <\/span>\u0219i <\/span>identifice <\/span>utilizarea <\/span>neautoriz<\/span>at\u0103 <\/span>a <\/span>sistemelor <\/span>sale <\/span>critice <\/span>pentru activitate <\/span>pri<\/span>n <\/span>detec\u021bia <\/span>conexiunilor\nlocale <\/span>neautorizate, <\/span>a <\/span>conexiunilor <\/span>de <\/span>re\u021bea <\/span>\u0219i <\/span>a <\/span>conexiunilor <\/span>l<\/span>a distan\u021b\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>organiza\u021bia\npoate <\/span>detecta <\/span>\u0219i <\/span>r\u0103spund<\/span>e <\/span>la <\/span>accesul neautorizat <\/span>sau <\/span>utilizarea <\/span>abuziv\u0103 <\/span>a <\/span>sistemelor\n<\/span>sale <\/span>critice <\/span>pentru activitate. <\/span>Aceasta <\/span>include identificarea\nconexiunilor locale, de re\u021b<\/span>ea sau la\ndistan\u021b\u0103 suspecte care ar putea indica o bre\u0219\u0103 de securitate sau utilizarea\nabuziv\u0103 <\/span>a sistemelor <\/span>sensibile.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Monitorizarea comunica\u021biilor de re<\/span>\u021bea ar trebui s\u0103 fie realizat\u0103 la gran<\/span>i\u021ba extern\u0103 a sistemelor or<\/span>ganiza\u021biei critice pentru activitate \u0219i la\ngrani\u021bele cheie in<\/span>terne din cadrul\nacestor sisteme.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Incintele <\/span>ar <\/span>trebui <\/span>monitorizate <\/span>pentru <\/span>detec\u021bia <\/span>re\u021belelor\n<\/span>wireless <\/span>neautorizate <\/span>sau <\/span>frauduloase <\/span>care ar putea permite atacatorilor s\u0103\nocoleasc\u0103 controalele normale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Serviciile <\/span>critice <\/span>de <\/span>re\u021bea, <\/span>precum <\/span>DNS <\/span>– <\/span>care <\/span>traduce <\/span>numele <\/span>site-urilor <\/span>w<\/span>eb <\/span>\u00een <\/span>adrese <\/span>IP<\/span>, <\/span>protocol de <\/span>rutare <\/span>inter<\/span>-domenii\n<\/span>(BGP) <\/span>– <\/span>care <\/span>ajut\u0103 <\/span>la <\/span>rutarea <\/span>traficului <\/span>de <\/span>internet, <\/span>\u0219i <\/span>alte <\/span>servicii\n<\/span>de <\/span>re\u021bea, ar trebui\nmonitorizate pentru detec\u021bia semnelor de manipu<\/span>lare\nsau utilizare abuziv\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Atunci <\/span>c\u00e2nd <\/span>sunt <\/span>g\u0103zd<\/span>uite <\/span>aplica\u021bii\n<\/span>accesibile <\/span>de <\/span>pe <\/span>internet, <\/span>ar <\/span>trebui <\/span>luat\u0103 <\/span>\u00een <\/span>considerare utilizarea unui firewall\npentru aplica\u021bii web (W<\/span>AF) pentru\nprotec\u021bie \u00eempo<\/span>triva atacurilor<\/span>. Dac\u0103 aplica\u021bia <\/span>nu <\/span>este <\/span>bazat\u0103 <\/span>pe <\/span>web, <\/span>aceasta <\/span>ar <\/span>trebui <\/span>protejat\u0103\n<\/span>utiliz\u00e2nd <\/span>alte <\/span>metode <\/span>adec<\/span>vate, <\/span>precum\nun IdP <\/span>pentru controlul accesului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-01.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>monitorizeze <\/span>continuu re\u021beaua <\/span>sa <\/span>pentru <\/span>detec\u021bia <\/span>semnelor de <\/span>amenin\u021b\u0103ri cibernetice sau activit\u0103\u021bi neobi\u0219nuite, utiliz\u00e2nd\nreguli clar definite pentru ceea este considerat u<\/span>n poten\u021bial <\/span>incident <\/span>de <\/span>securitate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 organiza\u021bia monitorizeaz\u0103 \u00een mod continuu re\u021beaua\n\u0219i sistemele sale pentru detec\u021bia semnelor de amenin\u021b\u0103ri cibernetice sau\nactivit\u0103\u021bi neobi\u0219<\/span>nuite. Acea<\/span>sta se <\/span>realizeaz\u0103 <\/span>utiliz\u00e2nd <\/span>re<\/span>guli <\/span>clar <\/span>definite <\/span>care <\/span>contribuie <\/span>la <\/span>identificarea <\/span>a <\/span>ceea <\/span>este <\/span>calificat <\/span>drept\n<\/span>un poten\u021bial <\/span>incident <\/span>de <\/span>securitate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Acest <\/span>Control <\/span>se <\/span>bazeaz\u0103\n<\/span>pe <\/span>DE.AE-08.1, <\/span>care <\/span>impune <\/span>raportarea <\/span>incidentelor <\/span>pe <\/span>baza <\/span>unor\ncriterii pred<\/span>efinite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021bia\nar trebui s\u0103 decid\u0103 ce tipuri de evenimente de securitate cibernetic\u0103 \u0219i semne\nde avertizare tr<\/span>ebuie monitorizate\n\u0219i s\u0103 defineasc\u0103 ce informa\u021bii trebuie \u00eenreg<\/span>istrate\n\u00een jurnalele de audit.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>utilizate <\/span>instrumente <\/span>automatizate <\/span>pentru <\/span>detec\u021bia\n<\/span>activit\u0103\u021bilor <\/span>suspecte, <\/span>precum <\/span>traficul\nnea\u0219teptat \u00een re\u021bea, \u00eencerc\u0103rile e\u0219uate de autentifi<\/span>care sau set\u0103<\/span>rile\nincorecte ale sistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Monitorizarea <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>flexibil\u0103\n<\/span>\u0219i <\/span>s\u0103 <\/span>fie <\/span>intensificat\u0103 \u00een <\/span>perioadele\n<\/span>cu <\/span>risc <\/span>ridicat, <\/span>precum atunci\nc\u00e2nd sunt primite alerte de amenin\u021bare, \u00een timpul tensiunilor geopolitice sau\ndup\u0103 apari\u021bia unor probleme interne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Monitorizarea  <\/span><\/span>ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>includ\u0103\n <\/span><\/span>nu  <\/span>numai  <\/span><\/span>sistemele  <\/span><\/span>digit<\/span>ale,  <\/span><\/span>ci  <\/span><\/span>\u0219i  <\/span><\/span>spa\u021biile  <\/span><\/span>fizice, comportamentul\npersonalului \u0219i interac\u021biunile cu furnizorii de servicii, acolo unde este\nrelevant.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Activitatea re\u021belei ar trebui\nanalizat\u0103 \u00een mod continuu pentru detec\u021bia modific\u0103rilor care ar putea indica o\nsl\u0103bire a <\/span>securit\u0103\u021bii, urm\u00e2nd\nprincipiile zero<\/span>-trust.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Alertele <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>declan\u0219ate\n<\/span>automat <\/span>atunci <\/span>c\u00e2nd <\/span>sunt <\/span>atinse <\/span>anumite <\/span>praguri, <\/span>iar <\/span>alarmele false cunoscute ar trebui fi<\/span>ltrate pentru evitarea suprasolicit\u0103rii\npersonalului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Mediul fizic este monitorizat pentru identificarea\nevenimentelor poten\u021bial adverse.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Mediul fizic trebuie monitorizat pentru identificarea\nevenimentelor poten\u021bial adverse.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 spa\u021biile fizice \u00een care <\/span>se afl\u0103 sistemele \u0219i datele critice sunt monitorizate pentru\ndetec\u021bia semnelor de activit\u0103\u021bi suspecte sau d\u0103un\u0103toare. Acest Control\ncontribuie la detec\u021bia poten\u021bialelor amenin\u021b\u0103ri, precum accesul neautorizat,\nmanipularea sau alte evenimente neobi\u0219nuite \u00een mediul fizic.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Jurnalele <\/span>sistemelor <\/span>de <\/span>acces\n<\/span>fizic <\/span>(precum <\/span>cititoarele <\/span>de <\/span>cartele) <\/span>ar <\/span>trebui <\/span>revizuite <\/span>pentru <\/span>detec\u021bia\ntiparelor neobi\u0219nuite, precum \u00eencerc\u0103rile de acces la <\/span>ore neobi\u0219nuite sau \u00eencerc\u0103rile de acces repetate e\u0219u<\/span>ate \u00eentr<\/span>-o\nzon\u0103 restric\u021bionat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cenregistr\u0103rile <\/span>accesului <\/span>vizitatorilor <\/span>(precum\n<\/span>foile <\/span>de <\/span>\u00eenregis<\/span>trare <\/span>sau <\/span>\u00eenregistr\u0103rile <\/span>digitale)\n<\/span>ar trebui <\/span>revizuite <\/span>periodic\n<\/span>pentru <\/span>a <\/span>asigura\n<\/span>c\u0103 numai <\/span>persoanele <\/span>fizice <\/span>care <\/span>sunt <\/span>autorizate <\/span>au <\/span>intrat\n\u00een zonele securizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Echipamentele <\/span>de <\/span>securitate <\/span>fizic\u0103\n<\/span>(precum <\/span>\u00eencuietori, <\/span>z\u0103voare,\n<\/span>\u0219tifturi <\/span>pentru <\/span>balamale\n<\/span>\u0219i <\/span>alarme) ar trebui\nverificate pentru detec\u021bia semnelor de manipulare sau deteriorare care ar putea\nindica o tentativ\u0103 de \u00eenc\u0103lcare a securit\u0103\u021bii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Accesul <\/span>fizic <\/span>la <\/span>sistemele\n<\/span>\u0219i <\/span>dispozitivele <\/span>critice ale <\/span>organiza\u021biei, <\/span>pe <\/span>l\u00e2ng\u0103 <\/span>monitorizarea <\/span>accesului fizic la incint\u0103, trebuie\ncompletat cu alarme de intruziune fizic\u0103, echipamente de supraveghere \u0219i echipe\nde monitorizare independente.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Con<\/span>trol este de a consolida protec\u021bia\nsistemelor \u0219i dispozitivelor critice prin completarea monitoriz\u0103rii fizice de\nbaz\u0103 a accesului cu detec\u021bia activ\u0103 a intruziunilor, tehnologii de supraveghere\n\u0219i capabilit\u0103\u021bi independ<\/span>ente de\nmonitorizare. Ac<\/span>easta contribuie la\nasigurarea detec\u021biei \u0219i r\u0103spunsului \u00een timp util la amenin\u021b\u0103rile la adresa\nsecurit\u0103\u021bii fizice.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele<\/span>:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Sistemele <\/span>de <\/span>detec\u021bie <\/span>a <\/span>intruziunilor <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>instalate\n<\/span>pentru <\/span>a <\/span>identifica <\/span>\u00eencerc\u0103rile <\/span>de intrare <\/span>fizic\u0103 <\/span>neautorizat\u0103.\nAceste <\/span>sisteme <\/span>pot <\/span>in<\/span>clude <\/span>senzori <\/span>de <\/span>mi\u0219care, <\/span>senzori <\/span>de <\/span>contact pentru <\/span>u\u0219i\/ferestre <\/span>\u0219i <\/span>detectoare <\/span>de <\/span>spar<\/span>gere <\/span>a <\/span>gea<\/span>murilor<\/span>, <\/span>care <\/span>declan\u0219eaz\u0103 <\/span>alerte <\/span>atunci <\/span>c\u00e2nd <\/span>sunt\ndetectate activit\u0103\u021bi neobi\u0219nuite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>ehnologiile  <\/span><\/span>de  <\/span><\/span>supraveghere,  <\/span><\/span>precum\n <\/span><\/span>camerele\n <\/span><\/span>CC<\/span>TV<\/span>,  <\/span>sistemele  <\/span><\/span>de  <\/span><\/span>\u00eenregistrare  <\/span><\/span>video  <\/span><\/span>\u0219i\nsistemele de control al accesului, ar trebui utilizate pentru monitorizarea \u0219i\n\u00eenregistrarea <\/span>\u00een mod continuu <\/span>a <\/span>activit\u0103\u021bii <\/span>din <\/span>zonele <\/span>sensibile.\n<\/span>Aceste <\/span>sisteme <\/span>contribuie\n<\/span>la <\/span>verificarea <\/span>incidentelor <\/span>\u0219i sprijin\u0103 <\/span>investiga\u021biile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Monitorizarea <\/span>vizitatorilor <\/span>ar <\/span>trebui intensificat\u0103 <\/span>prin <\/span>jurnalizarea <\/span>tuturor\n<\/span>intr\u0103rilor<\/span>, <\/span>inclusiv\n<\/span>a contractorilor \u0219i a p<\/span>e<\/span>rsonalului te<\/span>mporar<\/span>, utiliz\u00e2nd\nsisteme digitale sau jurnale manuale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Echipe independente de monitorizare,\nde obicei formate din profesioni\u0219ti externi \u00een domeniul securit\u0103\u021bii, <\/span>ar <\/span>trebui <\/span>angajate\n<\/span>pentru <\/span>supravegherea <\/span>sistemelor <\/span>de <\/span>supraveghere <\/span>\u0219i <\/span>pentru <\/span>r\u0103s<\/span>punsul\nla <\/span>incidente. <\/span>Aceste <\/span>echipe <\/span>aduc <\/span>expertiz\u0103 <\/span>specializat\u0103 <\/span>\u0219i <\/span>opereaz\u0103 <\/span>separat <\/span>de <\/span>personalul\n<\/span>intern, fiind important s\u0103 fie aplicate cerin\u021bele de securitate\ncibernetic\u0103 ale p\u0103r\u021bilor ter\u021be la opera\u021biunile lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Supravegherea <\/span>\u0219i <\/span>detec\u021bia <\/span>intruziunilor <\/span>ar <\/span>trebui <\/span>integrate\n<\/span>\u00een <\/span>opera\u021biuni <\/span>de securitate <\/span>mai <\/span>ample, permi\u021b\u00e2nd corelarea\nalertelor cu al\u021bi IoC fizici \u0219i digitali.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activitatea <\/span>personalului <\/span>\u0219i <\/span>utilizarea <\/span>tehnologiei <\/span>sunt <\/span>monitorizate <\/span>pentru <\/span>identificarea <\/span>evenimentelor poten\u021bial adverse.<\/span><\/p>\n\n

DE.CM-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>implementate <\/span>instrumente <\/span>de <\/span>protec\u021bie <\/span>a <\/span>endpoint<\/span>-urilor <\/span>\u0219i <\/span>a <\/span>re\u021belei <\/span>pentru <\/span>monitorizarea\ncomportamentului utilizatorilor finali \u00een ceea ce prive\u0219<\/span>te activit\u0103\u021bile periculoase.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Co<\/span>ntrol este de a <\/span>asigura c\u0103 organiza\u021bia poate detecta \u0219i r\u0103spunde la comportamentul\nriscant sau suspect al utilizatorilor at\u00e2t <\/span>pe\ndispozitive, c\u00e2t \u0219i \u00een re\u021bele. Acest Control contribuie <\/span>la <\/span>identificarea <\/span>amenin\u021b\u0103rilor, <\/span>precum <\/span>infectare <\/span>cu <\/span>malware, <\/span>utilizarea <\/span>abuziv\u0103 <\/span>a <\/span>siste<\/span>melor\nsau <\/span>\u00eencerc\u0103rile <\/span>de <\/span>ocolire <\/span>a <\/span>controalelor <\/span>de <\/span>securit<\/span>ate, <\/span>indiferent <\/span>dac\u0103 <\/span>sunt <\/span>cauzate\n<\/span>de <\/span>atacatori <\/span>externi sau interni.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021biile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare <\/span>u<\/span>tiliz<\/span>area <\/span>unei <\/span>\u00eembin\u0103ri\n<\/span>de <\/span>instrumente moderne <\/span>de securitate <\/span>care <\/span>func\u021bioneaz\u0103 <\/span>\u00eempreun\u0103 <\/span>pentru <\/span>oferirea <\/span>unei <\/span>imagini complete <\/span>a <\/span>activit\u0103\u021bii\nutilizatorilor \u0219i a sistemului:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>IDPS<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Aceste  <\/span><\/span>instrumente\n <\/span><\/span>monitorizeaz\u0103\n <\/span><\/span>traficul\n <\/span><\/span>de\n <\/span><\/span>re\u021b<\/span>ea  <\/span><\/span>\u0219i  <\/span><\/span>pot  <\/span><\/span>bloca  <\/span><\/span>sau  <\/span><\/span>alerta  <\/span><\/span>\u00een  <\/span><\/span>c<\/span>a<\/span>zul activit\u0103\u021bilor\nsuspecte, precum \u00eencer<\/span>c\u0103rile de\npiratare sau exploatarea vulnerabilit\u0103\u021bilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>W<\/span>AF-uri \u0219i\ngateway-uri <\/span>API<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Acestea <\/span>contribuie <\/span>la <\/span>protejarea <\/span>aplica\u021biilor <\/span>\u0219i <\/span>serviciilor <\/span>online <\/span>prin <\/span>filtrarea\n<\/span>traficului d\u0103un\u0103tor \u0219i prevenirea accesului neauto<\/span>rizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u00cen\n<\/span>plus, <\/span>o <\/span>abordare <\/span>stratificat\u0103 <\/span>care <\/span>utilizeaz\u0103 <\/span>instrumente <\/span>avansate <\/span>de <\/span>detec\u021bie\n<\/span>\u0219i <\/span>r\u0103s<\/span>puns <\/span>poate oferi\nvizibilitate \u00een timp real \u0219i un r\u0103spuns mai rapid:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Detec\u021bie\n\u0219i r\u0103spuns la nivel de endpoint (EDR)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Monitorizea<\/span>z\u0103 <\/span>activitatea <\/span>pe <\/span>dispozitive <\/span>individuale <\/span>(precum <\/span>laptopuri <\/span>sau <\/span>servere) <\/span>pentru detec\u021bia unor amenin\u021b\u0103ri precum\nmalware sau acces neautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Detec\u021bie\n\u0219i r\u0103spuns la nivel de re\u021bea (NDR)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Analizeaz\u0103 <\/span>traficul\n<\/span>de <\/span>re\u021bea <\/span>pentru\n<\/span>identificarea <\/span>tiparelor <\/span>neobi\u0219nuite, <\/span>precum <\/span>mi\u0219c\u0103ri\nlaterale sau atacuri ascunse.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Detec\u021bie\n\u0219i r\u0103spuns la amenin\u021b\u0103ri de identitate (ITDR)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Se <\/span>concentreaz\u0103 <\/span>pe <\/span>detec\u021bia <\/span>utiliz\u0103rii <\/span>abuzive <\/span>a <\/span>conturilor <\/span>de <\/span>utilizator<\/span>, <\/span>precum <\/span>date <\/span>de\nacces furate sau amenin\u021b\u0103ri din interior<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>UEBA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Utilizeaz\u0103 <\/span>\u00eenv\u0103\u021barea\n<\/span>automat\u0103 <\/span>pentru <\/span>\u00een\u021belegerea <\/span>c<\/span>omportamentului <\/span>normal <\/span>\u0219i <\/span>detec\u021bia anomaliilor care pot <\/span>indica o amenin\u021bare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste instrumente fac <\/span>parte dintr<\/span>-o strategie modern\u0103 de securitate pe mai multe niveluri \u0219i\nsunt adesea <\/span>men\u021bionate <\/span>\u00een <\/span>cele <\/span>mai <\/span>bune <\/span>p<\/span>ractici <\/span>\u0219i <\/span>cadre <\/span>din <\/span>industrie, <\/span>p<\/span>recum <\/span>T<\/span>riad<\/span>a <\/span>de <\/span>vizibilitate <\/span>a centrului de opera\u021biuni de securitate (SOC) introdus\u0103 de\nGartner<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Instrumentele de protec\u021bie a endpoint<\/span>-urilor \u0219i a re\u021belei care monitorizeaz\u0103\ncomportamentul utilizatorilor finali \u00een vederea detec\u021biei activit\u0103\u021bilor periculo<\/span>ase trebuie gestionate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest Control se bazea<\/span>z\u0103 pe DE.CM<\/span>-03.1, mut\u00e2nd accentul de la implementare la gestionarea continu\u0103\na instrumentelor de monitorizare. Obiectivul acest<\/span>ui Control este de a asigura c\u0103 instrumentele utilizate pentru <\/span>monitorizarea comportamentului\nutilizatorilor \u0219i detec\u021bia activit\u0103\u021bilor d\u0103un\u0103toare pe dispozitive \u0219i re\u021bele\nsunt men\u021binute corespunz\u0103tor \u0219i gestionate \u00een mod activ. Aceasta sus\u021bine <\/span>eficacitatea <\/span>continu\u0103 <\/span>a\ninstrumentelor <\/span>pe <\/span>m\u0103sur\u0103 <\/span>ce <\/span>amenin\u021b\u0103rile <\/span>evolueaz\u0103 <\/span>\u0219i <\/span>asigur\u0103\n<\/span>c\u0103 alertele pe care le genereaz\u0103 sunt precise, relevante \u0219i utile pentru\nidentificarea riscurilor reale de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instrumentele <\/span>care <\/span>monitorizeaz\u0103 <\/span>dispozitive <\/span>precum <\/span>laptopuri, <\/span>telefoane <\/span>mobile <\/span>\u0219i <\/span>servere\n<\/span>ar trebui <\/span>verificate <\/span>periodic\n<\/span>pentr<\/span>u <\/span>a <\/span>confirma <\/span>c\u0103 <\/span>func\u021bioneaz\u0103 <\/span>corect,\n<\/span>c\u0103 <\/span>sunt <\/span>actualizate <\/span>cu <\/span>cele <\/span>mai recente informa\u021bii privind\namenin\u021b\u0103rile \u0219i c\u0103 sunt capabile s\u0103 detec<\/span>teze\nnoi tip<\/span>uri de atacuri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ar <\/span>trebui <\/span>utilizat\n<\/span>un <\/span>sistem <\/span>cen<\/span>tral <\/span>pentru <\/span>colectarea <\/span>\u0219i <\/span>analizarea <\/span>jurnalelor <\/span>din <\/span>diferite <\/span>surse.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Aceste  <\/span><\/span>jurnale  <\/span><\/span>trebuie\n <\/span><\/span>s\u0103\n <\/span><\/span>fie\n <\/span><\/span>complete,\n <\/span><\/span>actualizate\n <\/span><\/span>\u0219i\n <\/span><\/span>utile\n <\/span><\/span>pentru\n <\/span><\/span>identificarea\n <\/span><\/span>activit\u0103\u021bilor\nsuspecte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Jurnalele legate de accesul la sis<\/span>tem, precum \u00eencerc\u0103rile de autentifica<\/span>re sau accesul \u00een afara programului <\/span>normal, <\/span>ar <\/span>trebui <\/span>revizuite <\/span>periodic. Ar <\/span>trebui <\/span>configurate <\/span>alerte <\/span>pentru <\/span>notificarea echipelor de securitate cu\nprivire la tiparele neobi\u0219nuite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instrumentele <\/span>care <\/span>analizeaz\u0103 <\/span>compor<\/span>tamentul <\/span>utilizatorilor <\/span>ar <\/span>trebui <\/span>ajustate <\/span>\u00een <\/span>timp. <\/span>Echipele\nde <\/span>securitate <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>revizuiasc\u0103 <\/span>alertele,\n<\/span>s\u0103 <\/span>ajusteze regulile <\/span>de <\/span>detec\u021bie <\/span>pentru <\/span>reducerea\nalarmelor false \u0219i \u00eembun\u0103t\u0103\u021birea preciziei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instrumentele de \u00een\u0219el\u0103ciune, precu<\/span>m sistemele sau f<\/span>i\u0219ierele false proi<\/span>ectate\npentru atragerea atacatorilor<\/span>, <\/span>ar <\/span>trebui <\/span>monitorizate <\/span>\u00eendeaproap<\/span>e. Alertele <\/span>generate\n<\/span>de <\/span>aceste <\/span>instrumente <\/span>sunt adesea semne timpurii ale unui atac real \u0219i trebuie tratate\ncu prioritate maxim\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Echipele de securitate ar trebui s\u0103 <\/span>evalueze periodic performan\u021ba tuturor\ninstrumentelor de monitorizare, s\u0103 actualizeze regulile de detec\u021bie \u0219i s\u0103\nasigure c\u0103 instrumentele sunt integrate \u00een procesele de r\u0103spuns la incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Rolurile \u0219i responsabilit\u0103\u021bile\nprivind monitorizarea \u0219i r\u0103spunsul <\/span>la\nalerte ar trebui definite \u00een mod clar<\/span>.\nPersona<\/span>lul ar trebui instruit s\u0103\nutilizeze in<\/span>strumentele \u00een mod\neficace \u0219i s\u0103 r\u0103spund\u0103 adecvat la incidente.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile  <\/span><\/span>\u0219i  <\/span><\/span>serviciile  <\/span><\/span>furnizorilor\n <\/span><\/span>externi\n <\/span><\/span>de\n <\/span><\/span>servicii\n <\/span><\/span>sunt\n <\/span><\/span>monitorizate\n <\/span><\/span>pentru\n <\/span><\/span>identificarea\nevenimentelor poten\u021bial adverse.<\/span><\/p>\n\n

DE.CM-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile <\/span>\u0219i <\/span>serviciile <\/span>furnizorilor <\/span>externi <\/span>de <\/span>servicii\n<\/span>trebuie <\/span>securiza<\/span>te <\/span>\u0219i <\/span>monitorizate <\/span>pentru identificarea evenimentelor poten\u021bial adverse.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>activit\u0103\u021bile <\/span>desf\u0103\u0219urate <\/span>de <\/span>furnizorii <\/span>externi\n<\/span>de <\/span>servicii<\/span>, fie la distan\u021b\u0103, fie la fa\u021ba locului,\nsunt gestionate \u00een mod securizat \u0219i monitorizate \u00een mod continuu. Aceasta\ncontribuie la detec\u021bia oric\u0103ror ac\u021biuni neobi\u0219nuite sau d\u0103un\u0103toa<\/span>re care ar putea afecta sistemele, datele\nsau serviciile organiza\u021biei.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Furnizorii externi ar putea include\ncontractori, <\/span>v\u00e2nz\u0103tori de servicii <\/span>cloud, echipe de asisten\u021b\u0103 IT<\/span>, dezvoltatori de <\/span>software \u0219i <\/span>alte <\/span>p\u0103r\u021bi <\/span>ter\u021be <\/span>implic<\/span>ate <\/span>\u00een <\/span>mentenan\u021ba, <\/span>dezvoltarea <\/span>sau <\/span>securitatea\nsistemului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea ar trebui s\u0103 <\/span>fie concentrat\u0103 pe:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Activitatea <\/span>de <\/span>acces\n<\/span>\u0219i <\/span>autentificare, <\/span>inclusiv\n<\/span>modul <\/span>\u0219i <\/span>momentul\n<\/span>\u00een <\/span>care <\/span>utilizatorii <\/span>externi <\/span>se conecteaz\u0103\nla sisteme.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ransferurile  <\/span><\/span>de  <\/span><\/span>date\n <\/span><\/span>\u0219i\n <\/span><\/span>traficul\n <\/span><\/span>de\n <\/span><\/span>re\u021bea,\n <\/span><\/span>pentru\n <\/span><\/span>detec\u021bia\n <\/span><\/span>mi<\/span>\u0219c\u0103rilor  <\/span><\/span>neobi\u0219nuite  <\/span><\/span>sau neautorizate de\ninforma\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Modific\u0103rile  <\/span><\/span>sistemului,\n <\/span><\/span>precum\n <\/span><\/span>actualiz\u0103rile\n <\/span><\/span>de\n <\/span><\/span>software\n <\/span><\/span>sau\n <\/span><\/span>ajust\u0103rile\n <\/span><\/span>de\n <\/span><\/span>configurare\nefectuate de p\u0103r\u021bi externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>oate\n<\/span>activit\u0103\u021bile <\/span>la <\/span>distan\u021b\u0103\n<\/span>\u0219i <\/span>la <\/span>fa\u021ba <\/span>locului\ndesf\u0103\u0219urate <\/span>de <\/span>furnizorii <\/span>exte<\/span>rni <\/span>ar <\/span>trebui <\/span>jurnalizate \u0219i revizuite pentru a\nidentifica ac\u021biu<\/span>nile neautorizate\nsau comportamentele riscante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Serviciile cloud \u0219i furnizorii de\ninternet ar trebui monitoriza\u021bi <\/span>pentru\ndetec\u021bia comportamentelor nea\u0219teptate sau a problemelor de performan\u021b\u0103 care ar\nputea indica o problem\u0103 de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>utilizat <\/span>un <\/span>sistem <\/span>centralizat <\/span>de <\/span>jurnalizare <\/span>pentru <\/span>colectarea <\/span>\u0219i <\/span>analizarea <\/span>datelor\n<\/span>de <\/span>la toate serviciile\nexterne.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Orice <\/span>incidente <\/span>de <\/span>securitate <\/span>care <\/span>implic\u0103 <\/span>fur<\/span>nizori <\/span>externi\n<\/span>– <\/span>precum <\/span>infectare\n<\/span>cu <\/span>malware, tentative <\/span>de <\/span>phishing <\/span>sau <\/span>acces <\/span>neautorizat <\/span>– ar <\/span>trebui <\/span>detectate\n<\/span>din <\/span>timp, <\/span>raportate\n<\/span>rapid <\/span>\u0219i solu\u021bionate \u00een mod\neficace.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-06.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Conformitatea <\/span>furnizorilor <\/span>externi <\/span>de <\/span>servicii <\/span>cu\npoliticile <\/span>\u0219i <\/span>procedurile de <\/span>securitate <\/span>a <\/span>personalului\n\u0219i cu cerin\u021bele de securitate din contract trebuie monitorizat\u0103 \u00een raport cu\nriscurile lor de securitate cibernetic\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a <\/span>asigura c\u0103\nfurnizorii externi de servicii respect\u0103 politicile de securitate a personalului\n\u0219i cerin\u021bele contractuale ale organiza\u021biei, \u00een special atunci c\u00e2nd au acces la\nsisteme <\/span>sau <\/span>date <\/span>sensibile. <\/span>Aceasta\n<\/span>contribuie <\/span>la <\/span>reducerea <\/span>ri<\/span>scului <\/span>de <\/span>incidente <\/span>de <\/span>s<\/span>e<\/span>curitate c<\/span>auzate de personalul ter\u021b \u0219i garanteaz\u0103\nc\u0103 furnizorii sunt supu\u0219i acelora\u0219i standarde ca \u0219i personalul intern.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Furnizorii  <\/span>externi \n<\/span>ar  <\/span>trebui  <\/span>s\u0103 \n<\/span>aib\u0103  <\/span>responsabilit<\/span>\u0103\u021bi \n<\/span>de  <\/span>securitate  <\/span>clar \n<\/span>definite,  <\/span>care  <\/span>sunt documentate \u00een contracte <\/span>sau SLA-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Contractele ar trebui s\u0103 includ\u0103 cerin\u021be precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>erific\u0103ri de\nfond ale personalului furnizorului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Semnarea\nacordurilor de confiden\u021bialitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Respectarea\npoliticilor de <\/span>utiliz<\/span>are acceptabil\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Respectarea  <\/span>acestor \n<\/span>cerin\u021be  <\/span>ar  <\/span>trebui \n<\/span>monitorizat\u0103  <\/span>periodic,  <\/span>inclusiv \n<\/span>verificarea  <\/span>finaliz\u0103rii\ncursurilor de instruire \u00een domeniul securit\u0103\u021bii \u0219i a semn\u0103rii acordurilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Furnizorii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>obliga\u021bi\n<\/span>s\u0103 <\/span>notifice <\/span>imediat\n<\/span>or<\/span>ganiza\u021bia <\/span>atunci <\/span>c\u00e2nd <\/span>personalul <\/span>cu <\/span>acces la <\/span>sistem <\/span>este <\/span>transferat <\/span>sau <\/span>\u00ee\u0219i <\/span>p\u0103r\u0103se\u0219te\n<\/span>func\u021bia, <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>drepturile <\/span>de <\/span>acces\ns\u0103 <\/span>poat\u0103 fi revocate f\u0103r\u0103 \u00eent\u00e2rziere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>efectuate <\/span>audituri\n<\/span>periodice <\/span>pentru <\/span>confirmarea <\/span>res<\/span>pect\u0103rii <\/span>politi<\/span>cilor <\/span>de <\/span>sec<\/span>uritate <\/span>de\nc\u0103tre furnizori. <\/span>Acestea pot include:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirea\njurnalelor de acces \u0219i a permisiunilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>erificarea\nprocedurilor <\/span>aferente pro<\/span>ceselor de <\/span>integrare \u0219i de ie\u0219ire or<\/span>ganiza\u021bional\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Asigurarea <\/span>faptului <\/span>c\u0103 <\/span>numai <\/span>persoanele <\/span>fizice <\/span>care <\/span>sunt <\/span>autorizate <\/span>au <\/span>acces <\/span>la <\/span>sistemele\ncritice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Orice probleme sau neconformit\u0103\u021bi ar\ntrebui documentate, raportate \u0219i solu\u021bionate prin ac\u021biuni corective \u0219i\nrevizuiri ulterioare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-09<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Hardware-ul <\/span>\u0219i <\/span>software-ul <\/span>de <\/span>calcul, <\/span>mediile\n<\/span>de <\/span>rulare <\/span>\u0219i <\/span>datele <\/span>acestora\n<\/span>sunt <\/span>moni<\/span>torizate\n<\/span>pentru identificarea evenimentelor poten\u021bial adverse.<\/span><\/p>\n\n

DE.CM-09.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>monitorizeze <\/span>hardware<\/span>-ul, <\/span>software-ul, <\/span>mediile <\/span>de <\/span>rulare\n<\/span>\u0219i <\/span>datele <\/span>aces<\/span>tora\npentru detec\u021bia evenimentelor poten\u021bial adverse.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest <\/span>Control\n<\/span>are <\/span>obiectivul <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>organiza\u021biile <\/span>monitorizeaz\u0103 <\/span>\u00een <\/span>mod <\/span>continuu\n<\/span>sistemele <\/span>\u0219i datele\ninformatice pentru detec\u021bia timpurie a ev<\/span>enimentelor\npoten\u021bial d\u0103un\u0103toare. Ac<\/span>easta\ncontribuie la <\/span>men\u021binere<\/span>a <\/span>vizibilit\u0103\u021bii, <\/span>la <\/span>sprijinire<\/span>a <\/span>r\u0103spunsurilor <\/span>\u00een <\/span>timp <\/span>util <\/span>\u0219i <\/span>reducerea\n<\/span>riscului <\/span>de <\/span>incidente\n<\/span>de securitate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Activarea <\/span>jurnaliz\u0103rii <\/span>sistemului <\/span>pe <\/span>computere <\/span>\u0219i <\/span>servere <\/span>pentru <\/span>\u00eenregistrarea <\/span>evenimentelor importante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Utilizarea <\/span>antivirusului <\/span>integrat\n<\/span>sau <\/span>protec\u021bia <\/span>pentru <\/span>endpoint<\/span>-uri <\/span>pentru <\/span>detec\u021bia\n<\/span>amenin\u021b\u0103rilor <\/span>\u0219i generarea\nalertelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Revizuirea <\/span>periodic\u0103 <\/span>a <\/span>jurnalelor <\/span>\u0219i <\/span>alertelor <\/span>pentru\n<\/span>identificarea <\/span>activit\u0103\u021bilor <\/span>neobi\u0219nuite <\/span>sau <\/span>a erorilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Stocarea <\/span>jurnalelor <\/span>\u00eentr<\/span>-un <\/span>folder <\/span>partajat <\/span>sau <\/span>\u00eentr<\/span>-un <\/span>vizuali<\/span>zator <\/span>de <\/span>jurnale\n<\/span>simplu, <\/span>pentru <\/span>a <\/span>le\naccesa \u0219i revizui mai u\u0219or<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Stabilirea <\/span>unei <\/span>rutine <\/span>(de <\/span>exemplu,\n<\/span>s\u0103pt\u0103m\u00e2nal\u0103 <\/span>sau <\/span>lunar\u0103)\n<\/span>pen<\/span>tru <\/span>verificarea <\/span>jurnalelor <\/span>\u0219i actualizarea instrumentelor de\nmonitorizare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Desemnarea <\/span>unei <\/span>persoane\n<\/span>responsabile <\/span>cu <\/span>monitorizarea, <\/span>chiar <\/span>dac\u0103 <\/span>este <\/span>o <\/span>func\u021bie\n<\/span>cu <\/span>jum\u0103tate de norm\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-09.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>implementeze <\/span>verific\u0103ri ale <\/span>integrit\u0103\u021bii <\/span>hardware<\/span>-ului <\/span>pentru <\/span>detec\u021bia modific\u0103rilor <\/span>neautorizate <\/span>ale <\/span>hardware<\/span>-ului critic <\/span>al <\/span>sistemul<\/span>ui. <\/span>C<\/span>ontroalele <\/span>trebuie <\/span>s\u0103 <\/span>fie propor\u021bionale cu profilul <\/span>de risc \u0219i <\/span>capacitatea opera\u021bional\u0103 a organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control\neste de a asigura protec\u021bia componentelor hardware critice \u00eempotriva\nmanipul\u0103rii neautorizate. Prin <\/span>implementarea\nun<\/span>or verific\u0103ri de integritate care\ncorespund nivelului de <\/span>risc <\/span>\u0219i <\/span>capacit\u0103\u021bii <\/span>opera\u021bionale <\/span>ale organiza\u021biei, <\/span>devine <\/span>posibil\u0103\n<\/span>detec\u021bia <\/span>modific\u0103rilor <\/span>fizice <\/span>sau <\/span>la nivel de firmware care ar putea\ncompromite securitatea.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea a ceea ce trebuie protejat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea <\/span>celor <\/span>mai <\/span>critice <\/span>sisteme,\n<\/span>precum <\/span>serverele <\/span>care <\/span>gestioneaz\u0103 <\/span>date <\/span>sensibile,\nICS\/SCADA <\/span>sau <\/span>dispozitivele <\/span>criptografice, <\/span>\u0219i <\/span>prioritizarea <\/span>lor <\/span>\u00een <\/span>func\u021bie\n<\/span>de <\/span>impactul <\/span>asupra activit\u0103\u021bii, cerin\u021bele legale \u0219i\nexpunerea la amenin\u021b\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alegerea nivelului adecvat de protec\u021bie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Selectarea <\/span>controalelor <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>c\u00e2t <\/span>de <\/span>criti<\/span>c <\/span>este <\/span>sistemul\n<\/span>\u0219i <\/span>de <\/span>ceea <\/span>ce <\/span>poate <\/span>suporta\nor<\/span>ganiza\u021bia:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>M\u0103suri\nde control de baz\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Camere de servere \u00eencuiate, sigilii inviolabile, pornire\nsecurizat\u0103 \u0219i audituri periodice ale hardware-ului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>M\u0103suri\nde control intermediare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>Alerte <\/span>la <\/span>deschiderea <\/span>hardware<\/span>-ului, <\/span>utilizar<\/span>ea <\/span>modulelor\n<\/span>de <\/span>platform\u0103 <\/span>de <\/span>\u00eencredere<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(TPM) \u0219i instrumente de validare a firmware<\/span>-ului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Controale <\/span>avansate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u2192 <\/span><\/span>V<\/span>alidarea de la distan\u021b\u0103 a st\u0103rii hardware<\/span>–u<\/span>lui,\nhardware criptografic rezistent la manipulare (module hardware de securitate <\/span>– HSM) \u0219i monitorizarea anomaliilor l<\/span>a nivel de hardware folosind inst<\/span>rumente de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Conectarea la opera\u021biunile de securita<\/span>te<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>ransmiterea <\/span>alertelor <\/span>de <\/span>la <\/span>instrumentele <\/span>de <\/span>integritate <\/span>hardware\n<\/span>c\u0103tre <\/span>sistemele <\/span>centrale\n<\/span>de monitorizare (precum SIEM sau SOC) pentru vizibilitate \u00een timp real.\nDefinirea modului de reac\u021bie \u00een cazul \u00een care este suspectat<\/span>\u0103 o manipulare frauduloas\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Atribuirea unor responsa<\/span>bilit\u0103\u021bi clare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Desemnarea  <\/span><\/span>rolurilor  <\/span><\/span>pentru  <\/span><\/span>proiectarea,\n <\/span><\/span>implementarea\n <\/span><\/span>\u0219i\n <\/span><\/span>r\u0103spunsul\n <\/span><\/span>la\n <\/span><\/span>problemele\n <\/span><\/span>de\nintegritate <\/span>hardware. <\/span>Utilizarea <\/span>profilurilor <\/span>de <\/span>rol<\/span>uri <\/span>(de <\/span>exemplu, <\/span>din ECSF\n<\/span>elaborat <\/span>de <\/span>c\u0103tre ENISA) pentru ghidarea\nresponsabilit\u0103\u021bilor:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Arhitec\u021bii\nde securitate proiecteaz\u0103 controalele.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Administratorii\nde sistem le im<\/span>plementeaz\u0103 \u0219i le\nmonitorizeaz\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Personalul\nde r\u0103spuns la incidente investigheaz\u0103 alertele.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Documentarea \u0219i revizuirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Includerea <\/span>verific\u0103rilor <\/span>de <\/span>integritate <\/span>ale <\/span>hardware<\/span>-ului <\/span>\u00een <\/span>politicile\n<\/span>de <\/span>securitate, <\/span>evalu\u0103rile riscurilor \u0219i jurnalele de\naudit. Re<\/span>vizuirea eficacit\u0103\u021bii\nacestora cel pu\u021bin anual sau dup\u0103 modific\u0103ri sau incidente majore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea personalului \u0219i con\u0219tientizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instruirea  <\/span><\/span>personalului  <\/span><\/span>relevant  <\/span><\/span>pentru\n <\/span><\/span>recuno<\/span>a\u0219terea  <\/span><\/span>semnelor  <\/span><\/span>de  <\/span><\/span>manipulare,  <\/span><\/span>pentru\nutilizarea corect\u0103 a instrumentelor de integritate <\/span>\u0219i pentru urmarea procedurilor de ra<\/span>portare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-09.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

IRP-ul <\/span>orga<\/span>niza\u021biei <\/span>trebuie\n<\/span>s\u0103 <\/span>includ\u0103 <\/span>m\u0103suri <\/span>pentru <\/span>detec\u021bia\n<\/span>manipul\u0103rii <\/span>neautoriza<\/span>te <\/span>a <\/span>hardwa<\/span>re<\/span>-ului sistemelor critice.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a\nasigura c\u0103 <\/span>IRP<\/span>-ul <\/span>organiza\u021biei <\/span>include\n<\/span>m\u0103suri <\/span>pentru <\/span>detec\u021bi<\/span>a <\/span>\u0219i r\u0103spunsul <\/span>la <\/span>mani<\/span>pularea <\/span>neautorizat\u0103 <\/span>a <\/span>hardware<\/span>-ului <\/span>critic. <\/span>Aceasta\n<\/span>ajut\u0103 <\/span>organiza\u021bia <\/span>s\u0103 <\/span>reac\u021bioneze\nrapid <\/span>\u0219i <\/span>eficace <\/span>\u00een <\/span>cazul \u00een <\/span>care <\/span>cineva <\/span>\u00eencearc\u0103\ns\u0103 <\/span>compromit\u0103 <\/span>fizic <\/span>sau <\/span>digital <\/span>sisteme <\/span>importa<\/span>nte.\nAcest Control poate fi implementat \u00eentr-un mod practic \u0219i scalabil.<\/span><\/p>\n\n

Lu\u00e2nd \u00een considerare\nm\u0103surile de mai jos, inclusiv organiza\u021biile mici pot include \u00een mod eficace\ndetec\u021bia manipul\u0103rii hardware \u00een capabilit\u0103\u021bile lor de r\u0103spuns la incidente,\nf\u0103r\u0103 a necesita resurse extinse:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>IRP<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>IRP-ul <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>includ\u0103 <\/span>instruc\u021biuni <\/span>clar<\/span>e <\/span>privind\n<\/span>m\u0103surile <\/span>care <\/span>trebuie\n<\/span>luate <\/span>\u00een <\/span>cazul\n<\/span>\u00een care este suspectat\u0103 manipularea hardware<\/span>-ului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Inspec\u021bii periodice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Personalul <\/span>IT <\/span>\u0219i <\/span>OT <\/span>sau <\/span>personalul <\/span>desemnat\n<\/span>va <\/span>inspecta <\/span>periodic <\/span>hardware<\/span>-ul <\/span>critic <\/span>pentru detec\u021bia semnelor de manipulare,\nprecum sigilii <\/span>rupte, cabluri sl\u0103bite\nsau modific\u0103ri nea\u0219teptate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instrumente de monitoriz<\/span>are<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pot <\/span>fi <\/span>utilizate <\/span>instrumente <\/span>simple <\/span>pentru\n<\/span>trimiterea <\/span>alertelor<\/span>, <\/span>atunci <\/span>c\u00e2nd <\/span>se <\/span>\u00eent\u00e2mpl\u0103\n<\/span>ceva neobi\u0219nuit <\/span>cu <\/span>un <\/span>dispozitiv<\/span>, <\/span>precum <\/span>deschiderea <\/span>carcasei, <\/span>conectarea <\/span>unui <\/span>nou <\/span>disp<\/span>ozitiv <\/span>USB sau\n<\/span>repornirea <\/span>nea\u0219teptat\u0103 <\/span>a <\/span>sistemului. <\/span>Multe\n<\/span>dintre <\/span>aceste <\/span>instrumente <\/span>sunt <\/span>proiectate <\/span>pentru a fi accesibile \u0219i u\u0219or de\nutilizat, \u00een special pentru or<\/span>ganiza\u021biile\nmici.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea <\/span>\u0219i <\/span>con\u0219tientizarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instruirea <\/span>angaja\u021bilor <\/span>s\u0103 <\/span>recunoasc\u0103 <\/span>semnele\n<\/span>de <\/span>manipulare <\/span>a <\/span>hardware-ului <\/span>\u0219i <\/span>s\u0103 <\/span>raporteze orice activitate suspect\u0103.\nCon\u0219tientizarea este ese<\/span>n\u021bial\u0103\npentru detec\u021bia timpurie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asisten\u021b\u0103 din partea v\u00e2nz\u0103torului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>instrumentelor <\/span>sau <\/span>serviciilor <\/span>oferite\n<\/span>de <\/span>v\u00e2nz\u0103torii <\/span>de <\/span>hardware <\/span>pentru <\/span>detec\u021bia\nmanipul\u0103rilor frauduloase, adesea incluse \u00een contractele de asisten\u021b\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.CM-09.4<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Or<\/span>ganiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>stabileasc\u0103 <\/span>un <\/span>sistem <\/span>pentru <\/span>a <\/span>distinge\n<\/span>cu <\/span>precizie <\/span>\u00eentre <\/span>alertele <\/span>legitime\n<\/span>\u0219i falsele pozitive, asigur\u00e2nd detec\u021bia \u0219i eliminarea eficace a <\/span>codurilor cu scop nelegitim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 or<\/span>ganiza\u021bia poate\nidentifica cu precizie amenin\u021b\u0103rile reale, <\/span>evit\u00e2nd <\/span>\u00een <\/span>acela\u0219i <\/span>timp <\/span>alertele <\/span>inutile\n<\/span>cauzate <\/span>de <\/span>falsele\n<\/span>pozitive. <\/span>Aceasta  <\/span>contribuie\n<\/span>la \u00eembun\u0103t\u0103\u021birea <\/span>eficacit\u0103\u021bii <\/span>detec\u021biei\n<\/span>\u0219i <\/span>elimin\u0103rii <\/span>codurilor\n<\/span>cu <\/span>scop <\/span>nelegitim, <\/span>reduc\u00e2nd <\/span>\u00een <\/span>acela\u0219i <\/span>timp timpul \u0219i resursele irosite pentru a\nr\u0103spunde la activit\u0103\u021bi inofensive.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Pentru <\/span>a <\/span>contribui <\/span>la <\/span>detec\u021bia <\/span>\u0219i <\/span>eliminarea <\/span>eficace\n<\/span>a <\/span>coduril<\/span>or <\/span>cu <\/span>scop <\/span>nelegitim, <\/span>evit\u00e2nd\n<\/span>\u00een <\/span>acela\u0219i timp alarmele\nfalse, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualiz\u0103ri <\/span>automate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>de <\/span>protec\u021bie\n<\/span>\u00eempotriva <\/span>codurilor <\/span>cu <\/span>scop <\/span>nelegitim\n<\/span>ar <\/span>trebui <\/span>configurate <\/span>s\u0103 <\/span>se actualizeze\nautomat, acolo unde este po<\/span>sibil, sau\nmanual, conform unui program definit, \u00een conformitate cu politicile or<\/span>ganiza\u021biei \u0219i constr\u00e2ngerile opera\u021bionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Practici de dezvoltare securizate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Software-ul utilizat \u00een sistemele IT <\/span>\u0219i OT <\/span>ar trebui s\u0103\nrespecte practicile de dezvoltare sigur\u0103, inclusiv revizuirea codului \u0219i\nverificarea vulnerabilit\u0103\u021bilor<\/span>, \u00een\nvederea reducerii riscului de introducere de cod cu scop nelegitim.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protec\u021bie stratificat\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>At\u00e2t <\/span>protec\u021bia <\/span>bazat\u0103 <\/span>pe <\/span>semn\u0103turi\n<\/span>(c<\/span>are <\/span>detectea<\/span>z\u0103 <\/span>amenin\u021b\u0103rile <\/span>cunoscute), <\/span>c\u00e2t <\/span>\u0219i <\/span>protec\u021bia\nbazat\u0103 pe comportament (care caut\u0103 activit\u0103\u021bi neobi\u0219nuite sau suspecte) ar trebui\nutilizate \u00een locurile \u00een care re\u021belele se conecteaz\u0103 la internet, \u00een care\npersonalul acce<\/span>seaz\u0103 sistemele de\ncontrol \u0219i \u00een care fi\u0219ierele sau datele sunt partajate \u00eentre sisteme.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Scanarea <\/span>amenin\u021b\u0103rilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Instrumentele <\/span>de <\/span>protec\u021bie <\/span>ar <\/span>trebui <\/span>setate\n<\/span>s\u0103 <\/span>efe<\/span>ctueze <\/span>scan\u0103ri <\/span>regulate\n<\/span>\u0219i, <\/span>acolo <\/span>unde <\/span>este\nfezabil, verific\u0103ri \u00een timp real ale fi<\/span>\u0219ierelor\n\u0219i transferurilor <\/span>de date, \u00een special\nale celor provenite din surse externe sau de pe medii amovibile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Blocarea \u0219i carantina<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Codul <\/span>cu <\/span>scop <\/span>nelegitim <\/span>detectat\n<\/span>ar <\/span>trebui <\/span>blocat <\/span>\u0219i <\/span>izolat <\/span>pentru <\/span>\u00eempiedicarea <\/span>afect\u0103rii <\/span>altor\nsisteme. <\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>aceasta <\/span>ar <\/span>tr<\/span>ebui <\/span>realizat\u0103 <\/span>\u00eentr<\/span>-un <\/span>mod <\/span>care <\/span>s\u0103 <\/span>nu <\/span>perturbe\n<\/span>opera\u021biunile critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alerte \u0219i notific\u0103ri<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Atunci <\/span>c\u00e2nd <\/span>sunt <\/span>detectate <\/span>coduri <\/span>cu <\/span>scop <\/span>nelegitim, <\/span>ar <\/span>trebui <\/span>trimise\n<\/span>alerte <\/span>personalului desemnat,\ncu proceduri clare de r\u0103spuns at\u00e2t \u00een contextul IT<\/span>, c\u00e2t \u0219i \u00een cel OT<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[DE.AE]\nANALIZA EVENIMENTELOR ADVERSE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Anomaliile, IoC-urile \u0219i\nalte evenimente poten\u021bial adverse sunt analizate pentru caracterizarea\nevenimentelor \u0219i detec\u021bia incidentelor de securitate cibernetic\u0103.<\/span><\/p>\n\n

DE.AE-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Evenimentele poten\u021bial adverse sunt analizate pentru a\n\u00een\u021belege mai bine activit\u0103\u021bile asociate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Evenimentele legate de securitatea\ncibernetic\u0103 sau a informa\u021biei trebuie revizuite \u0219i analizate pentru\nidentificarea poten\u021bialelor \u021binte \u0219i metode de atac, \u00een conformitate cu legile,\nreglement\u0103rile, standardele <\/span>\u0219i <\/span>pol<\/span>iticile <\/span>aplicabile.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 evenimentele legate de securitatea cibernetic\u0103 sau\na informa\u021biei sunt revizuite \u0219i analizate pentru detec\u021bia \u021bintelor \u0219i metodelor\nde atac. Aceasta permite organiza\u021biilor s\u0103 r\u0103spund\u0103 \u00een mod eficace la\namenin\u021b\u0103ri, men\u021bin\u00e2nd \u00een ace<\/span>la\u0219i timp\nconformitatea cu cerin\u021bele legale, de reglementare \u0219i de politic\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Or<\/span>ganiza\u021biile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>respecte <\/span>legisla\u021bia <\/span>\u00een <\/span>vigoare, <\/span>sta<\/span>ndardele <\/span>\u0219i <\/span>politicile <\/span>interne,\n<\/span>atunci c\u00e2nd se analizeaz\u0103 evenimentele de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instrumentele  <\/span>de \n<\/span>analiz\u0103  <\/span>a  <\/span>jurnale<\/span>lor  <\/span>ar \n<\/span>trebui  <\/span>utilizate  <\/span>pentru \n<\/span>generarea  <\/span>de  <\/span>rapoarte \n<\/span>\u0219i identificarea activit\u0103\u021bii suspecte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Jurnalele  <\/span>de \n<\/span>sistem  <\/span>\u0219i  <\/span>de \n<\/span>aplica\u021bii  <\/span>ar  <\/span>trebui \n<\/span>revizuite  <\/span><\/span>periodic  <\/span>pentru \n<\/span>detec\u021bia  <\/span>semnelor  <\/span>de amenin\u021b\u0103ri la adresa securit\u0103\u021bii, precum\n\u00eencerc\u0103ri repetate de autentificare e\u0219uate sau transferuri de date neobi\u0219nuite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Jurnalele <\/span>ar <\/span>trebui <\/span>analizate\n<\/span>pentru <\/span>identificarea <\/span>ti<\/span>parelor <\/span>care <\/span>indic\u0103 <\/span>tentative\n<\/span>de <\/span>atac <\/span>sau <\/span>ata<\/span>curi \u00een curs.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Informa\u021biile <\/span>privind <\/span>amenin\u021b\u0103rile <\/span>ar <\/span>trebui <\/span>utilizate <\/span>pentru <\/span>a <\/span>fi <\/span>la <\/span>curent\n<\/span>cu <\/span>amenin\u021b\u0103rile <\/span>emer<\/span>gente\n\u0219i tehnicile de atac, iar m\u0103surile de securitate ar trebui ajustate \u00een\nconsecin\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar \n<\/span>trebui  <\/span>efectuate  <\/span>audituri \n<\/span>\u0219i  <\/span>evalu\u0103ri  <\/span>periodice \n<\/span>pentru  <\/span><\/span>evaluarea  <\/span>posturii \n<\/span>de  <\/span>securitate  <\/span>a or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Rezultatele acestor audituri ar\ntrebui utilizate <\/span>pentru \u00eembun\u0103t\u0103\u021birea\nproceselor de monitorizare \u0219i analiz\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia  <\/span><\/span>trebuie  <\/span><\/span>s\u0103  <\/span><\/span>implementeze\n <\/span><\/span>mecanisme\n <\/span><\/span>automatizate,\n <\/span><\/span>acolo\n <\/span><\/span>unde\n <\/span><\/span>este\n <\/span><\/span>fezabil,\n <\/span><\/span>pentru\nrevizuirea \u0219i analizarea evenimentelor detectate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 organiza\u021bia utilizeaz\u0103 automatizarea, acolo unde\neste practic, <\/span>pentru <\/span>sprijinirea <\/span>revizuirii <\/span>\u0219i <\/span>analiz\u0103rii <\/span>eficiente <\/span>\u0219i <\/span>consecven<\/span>te <\/span>a <\/span>evenimentelor <\/span>de <\/span>securitate\ncibernetic\u0103 detectate. Aceasta contribuie la reducerea riscului de eroare\numan\u0103, accelereaz\u0103 detec\u021bia amenin\u021b\u0103rilor \u0219i r\u0103spunsul la acestea \u0219i permit<\/span>e resurselor de securitate limitate (\u00een\nspecial \u00een organiza\u021biile <\/span>mai mici) <\/span>s\u0103 <\/span>se <\/span>concentreze <\/span>pe <\/span>sarc<\/span>ini <\/span>cu <\/span>valoare mai mare, <\/span>precum <\/span>investigarea\nincidentelor complexe sau \u00eembun\u0103t\u0103\u021birea ap\u0103r\u0103rii.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Utilizarea capabilit\u0103\u021bilor integrate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Activarea <\/span>\u0219i <\/span>configurarea <\/span>func\u021biilor <\/span>de <\/span>jurnali<\/span>zare <\/span>\u0219i <\/span>alertare <\/span>\u00een <\/span>platformele <\/span>existente\n<\/span>(de exemplu, <\/span>Microsoft <\/span>365, <\/span>Google\nW<\/span>orkspace, <\/span>firewall<\/span>-uri) <\/span>pentru <\/span>detec\u021bia <\/span>automat\u0103\n<\/span>a activit\u0103\u021bilor <\/span>suspecte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Implementarea de instrumente de detec\u021bie u\u0219oar\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>solu\u021biilor <\/span>accesibile <\/span>EDR <\/span>care <\/span>ofer\u0103\n<\/span>alerte <\/span>automate <\/span>\u0219i <\/span>analize <\/span>de <\/span>baz\u0103, <\/span>precum detec\u021bia malware-ului sau a\ncomportamentului neobi\u0219nuit de autentificare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Luarea \u00een co<\/span>nsiderare\na serviciilor de detec\u021bie gestionate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>or<\/span>ganiza\u021biile <\/span>cu <\/span>resurse <\/span>interne\n<\/span>limitate, <\/span>serv<\/span>iciile <\/span>gestionate <\/span>de <\/span>detec\u021bie <\/span>\u0219i <\/span>r\u0103spuns<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(MDR)\npot furniza monitorizare externalizat\u0103, detec\u021bia amenin\u021b\u0103rilor \u0219i r\u0103spuns la\nincidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Automatizarea zonelor cu impact ridicat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Concentrarea\nautomatiz\u0103rii pe indicatori comuni de amenin\u021bare, precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Multiple\ntentative e\u0219uate de autentificare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Acces\nneobi\u0219nuit la fi\u0219iere sensibile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>T<\/span>rafic de ie\u0219<\/span>ire nea\u0219teptat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea informa\u021biilor privind amenin\u021b\u0103rile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>fluxurilor <\/span>de <\/span>informa\u021bii <\/span>privind\n<\/span>amenin\u021b\u0103rile <\/span>gratuite <\/span>sau <\/span>la <\/span>pre\u021b <\/span>redus <\/span>pentru \u00eembun\u0103t\u0103\u021birea <\/span>instrumentelor <\/span>de <\/span>detec\u021bie cu <\/span>IoC<\/span>-uri <\/span>cunoscute \u0219i <\/span>comportamente <\/span>ale\natacatorilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea practicilor de revizuire manual\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Programarea <\/span>revizuirilor <\/span>manuale\n<\/span>regulate <\/span>ale <\/span>jurnalelor <\/span>\u0219i <\/span>alertelor <\/span>pentru\n<\/span>identificarea amenin\u021b\u0103rilor <\/span>pe <\/span>care <\/span>instrumentele <\/span>automate\n<\/span>le <\/span>pot <\/span>omite, <\/span>\u00een <\/span>special\n<\/span>cele <\/span>care <\/span>implic\u0103\n<\/span>tehnici de atac noi sau subtile.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Informa\u021biile sunt corelate din surse multiple.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Func\u021bionalitatea de\njurnalizare a instrumentelor de protec\u021bie \u0219i detec\u021bie trebuie <\/span>activat\u0103. Jurnalele trebuie salvate \u0219i\np\u0103strate pentru o perioad\u0103 predefinit\u0103 \u0219i revizuite periodic pentru\nidentificarea activit\u0103\u021bilor neobi\u0219nuite sau poten\u021bial d\u0103un\u0103toare.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 instrumentele <\/span>de\nsecuritate au func\u021bia de jurnalizar<\/span>e\nactivat\u0103, c\u0103 jurnalele sunt p\u0103strate pentru o perioad\u0103 determinat\u0103 \u0219i\nverificate periodic pentru identificarea activit\u0103\u021bii neobi\u0219nuite sau\nd\u0103un\u0103toare. Aceasta contribuie la detec\u021bia timpurie a amenin\u021b\u0103rilor \u0219i luarea <\/span>de m\u0103suri. E<\/span>xemple de astfel de instrumente includ firewall<\/span>-uri, software antivirus, sisteme de\ndetec\u021bie a endpoint<\/span>-urilor \u0219i sisteme\nde detec\u021bie a intruziunilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Jurnalele <\/span>ar <\/span>trebui <\/span>stocate\n<\/span>\u00een <\/span>mod <\/span>se<\/span>curizat <\/span>\u0219i <\/span>p\u0103strate <\/span>conform\n<\/span>unui <\/span>program <\/span>de <\/span>p\u0103strare <\/span>definit, pe baza cerin\u021belor legale, de\nreglementare sau opera\u021bionale a<\/span>plicabile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instrumentele <\/span>\u0219i <\/span>solu\u021biile <\/span>de <\/span>detec\u021bie <\/span>a <\/span>evenimentelor <\/span>ar <\/span>trebui <\/span>configurate <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>genereze\nalerte automate pentru activit\u0103\u021bi suspecte sau d\u0103un\u0103toare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>s\u0103  <\/span><\/span>existe  <\/span><\/span>o  <\/span>procedur\u0103  <\/span><\/span>documentat\u0103  <\/span><\/span>pentru  <\/span><\/span>revizuirea\n <\/span><\/span>periodic\u0103\n <\/span><\/span>a\n <\/span><\/span>jurnalelor\n <\/span><\/span>\u0219i\n <\/span><\/span>a\ntablourilor de bord, pentru sprijinirea detec\u021biei \u0219i r\u0103spunsul \u00een timp util.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Revizuirile jurnalelor ar trebui s\u0103\ninclud\u0103 verific\u0103ri ale tiparelor<\/span>, precum\ninfectare cu malware repetat\u0103, <\/span>trafic <\/span>de <\/span>re\u021bea <\/span>anormal\n<\/span>sau <\/span>acces <\/span>excesiv\n<\/span>la <\/span>site<\/span>-uri <\/span>web <\/span>care <\/span>nu <\/span>au <\/span>leg\u0103tur\u0103 <\/span>cu <\/span>activitatea\nor<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dac\u0103 sunt identificate astfel de\ntipare, <\/span>ar trebui definite ac<\/span>\u021biuni de urm\u0103rire, precum consolidarea\ncontroalelor de securitate specifice, actualizarea regulilor de detec\u021bie sau or<\/span>ganizarea de instruire \u021bintit\u0103 pentru\ncon\u0219tientizare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-03.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>se <\/span>asigure <\/span>c\u0103 <\/span>datele <\/span>privind <\/span>evenimentele <\/span>din <\/span>si<\/span>stemele\n<\/span>critice <\/span>sunt <\/span>colectate\n<\/span>\u0219i corelate utiliz\u00e2nd informa\u021bii din mai multe surse relevante.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\npermite organiza\u021biei s\u0103 detecteze amenin\u021b\u0103ri complexe sau distribuite prin\ncorelarea \u0219i analizarea date<\/span>lor\nprivind evenimentele provenite din diferite sisteme \u0219i surse. <\/span>Corelarea\n<\/span>acestor <\/span>date <\/span>contri<\/span>buie <\/span>la <\/span>identificarea <\/span>unor <\/span>tipare\ncare <\/span>ar <\/span>putea <\/span>s\u0103 <\/span>nu <\/span>fie <\/span>vizibile atunci c\u00e2nd sistemele sunt\nmonitorizate separat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar tr<\/span>ebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Sursele relevante de date despre\nevenimente pot include jurnale de sistem, jurnale de audit, instrumente <\/span>de <\/span>monitorizare <\/span>a <\/span>re\u021bele<\/span>i, <\/span>\u00eenregistr\u0103ri <\/span>ale <\/span>accesului <\/span>fizic <\/span>\u0219i <\/span>rapoarte\n<\/span>de <\/span>la utilizatori sau administratori.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Datele <\/span>din <\/span>jurnale <\/span>ar <\/span>trebui <\/span>trimise\n<\/span>\u00een <\/span>mod <\/span>continuu, <\/span>ideal <\/span>\u00een <\/span>timp <\/span>real <\/span>sau <\/span>aproape\n<\/span>\u00een <\/span>timp <\/span>real, c\u0103tre <\/span>un <\/span>sistem\n<\/span>centralizat <\/span>pentru <\/span>stoc<\/span>are <\/span>\u0219i <\/span>analiz\u0103. <\/span>Aceasta\n<\/span>\u00eem<\/span>bun\u0103t\u0103\u021be\u0219te <\/span>capacitatea <\/span>de <\/span>a <\/span>detecta tipare \u0219i de a r\u0103spunde rapid la poten\u021biale\nprobleme.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Centralizarea jurnalelor pe un num\u0103r\nmic de servere sau platforme dedicate, precum SIEM, instrumente u\u0219oare de\ngestionare a jurnalelor<\/span>, servicii de\njurnalizare bazate pe cloud sau servicii de detec\u021bie gestionate (deseori parte\na MDR), poate sprijini analiza \u0219<\/span>i\ncorelarea eficient\u0103 a evenimentelor \u00eentre sisteme.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Informa\u021biile privind amenin\u021b\u0103rile\ncibernetice pot fi utilizate pentr<\/span>u\n\u00eembun\u0103t\u0103\u021birea corel\u0103rii evenimentelor<\/span>,\noferind contextul privind amenin\u021b\u0103rile cunoscute, metodele de atac \u0219i IoC<\/span>-uri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Informa\u021biile <\/span>privind <\/span>ame<\/span>nin\u021b\u0103rile <\/span>ar <\/span>trebui <\/span>integrate <\/span>\u00een <\/span>mod <\/span>securizat <\/span>\u00een <\/span>instrumentele <\/span>\u0219i <\/span>procesele\nde detec\u021bie pentru sprijinirea identific\u0103rii mai precis\u0103 \u0219i mai rapid\u0103 a\namenin\u021b\u0103rilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-03.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie\n<\/span>s\u0103 <\/span>combine <\/span>anali<\/span>za <\/span>evenimentelor <\/span>c<\/span>u informa\u021bii <\/span>provenite\n<\/span>din <\/span>scan\u0103ri <\/span>de vulnerabilitate, <\/span>date <\/span>privind <\/span>performan\u021ba <\/span>sistemului, <\/span>monitorizarea <\/span>sistemelor <\/span>critice <\/span>\u0219i <\/span>monitorizarea incintelor, acolo unde este\nfezabil.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>consolida <\/span>capacitat<\/span>ea <\/span>organiza\u021biei <\/span>de <\/span>detec\u021bie <\/span>a <\/span>amenin\u021b\u0103rilor\ncomplexe sau ascunse prin combinarea analizei evenimentelor cu alte surse de\ndate relevante. Aceast\u0103 <\/span>viziune <\/span>mai <\/span>ampl\u0103 <\/span>permite\n<\/span>identificarea <\/span>mai <\/span>precis\u0103\n<\/span>\u0219i <\/span>mai <\/span>rapid\u0103 <\/span>a <\/span>activit\u0103\u021bilor <\/span>suspecte, <\/span>iar \u00een\nvederea real<\/span>iz\u0103rii acestui obiectiv,\nar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Ar <\/span>trebui <\/span>utilizate <\/span>instrumente <\/span>care <\/span>colecteaz\u0103 <\/span>\u0219i <\/span>conecteaz\u0103 <\/span>date <\/span>din <\/span>diferite\n<\/span>sisteme <\/span>(precum<\/span><\/p>\n\n

 <\/span><\/p>\n\n

SIEM,\nXDR sau SOAR) pentru a sprijini aceast\u0103 integrare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Problemele <\/span>de <\/span>securitate <\/span>raportate <\/span>de <\/span>furnizori\n<\/span>sau <\/span>surse <\/span>de <\/span>\u00eencredere <\/span>ar <\/span>tr<\/span>ebui <\/span>colectate <\/span>rapid <\/span>\u0219i\nrevizuite pe<\/span>ntru identificarea\neventualelor riscuri<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Datele <\/span>din <\/span>diferite <\/span>siste<\/span>me <\/span>de <\/span>monitorizare <\/span>ar <\/span>trebui <\/span>reunite <\/span>pentru <\/span>facilitarea <\/span>detec\u021biei <\/span>tiparelor sau\nproblemelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Configura\u021bia <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>permit\u0103\n<\/span>detec\u021bia <\/span>\u0219i <\/span>r\u0103spunsul\n<\/span>rapid <\/span>atunci <\/span>c\u00e2nd <\/span>este <\/span>constatat\n<\/span>ceva neobi\u0219nuit.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Impactul \u0219i amploarea esti<\/span>mate ale evenimentelor <\/span>adverse\nsunt \u00een\u021belese.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>evalue<\/span>ze <\/span>impacturile <\/span>negative <\/span>ale <\/span>eveniment<\/span>elor <\/span>detectate\n<\/span>asupra <\/span>opera\u021biunilor,\nactivelor \u0219i persoanelor sale fizice \u0219i s\u0103 coreleze aceste impacturi cu\nrezultatele evalu\u0103rilor sale de riscuri.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>organiza\u021bia\n\u00een\u021belege modul <\/span>\u00een <\/span>care ev<\/span>enimentele\ndetectate ar putea cauza prejudicii \u0219i utilizeaz\u0103 aceast\u0103 \u00een\u021belegere pentru a\nghida deciziile \u0219i r\u0103spunsurile bazate pe risc.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Pentru <\/span>a <\/span>sprijini\n<\/span>aceast\u0103 <\/span>evaluare, <\/span>ar <\/span>trebui <\/span>utilizate\n<\/span>instrumente <\/span>care <\/span>ajut\u0103 <\/span>la <\/span>estimarea\n<\/span>amplorii \u0219i impactului evenimentelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Evaluarea <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>ia <\/span>\u00een <\/span>considerare <\/span>modul\n<\/span>\u00een <\/span>care <\/span>problemele <\/span>dintr-o <\/span>parte <\/span>a <\/span>sistemului <\/span>a<\/span>r\nputea afecta <\/span>alte p\u0103r\u021bi conectate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Impactul  <\/span><\/span>negativ  <\/span><\/span>poate  <\/span><\/span>include\n <\/span><\/span>pierderi\n <\/span><\/span>financiare,\n <\/span><\/span>\u00eentreruperea\n <\/span><\/span>serviciilor<\/span>,  <\/span><\/span>deteriorarea echipamentelor sau v\u0103t\u0103marea\npersoanelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Evenimentele <\/span>detectate <\/span>pot <\/span>include <\/span>incidente\n<\/span>cibernetice, <\/span>defec\u021biuni <\/span>ale <\/span>sistemului <\/span>sau <\/span>dezastre\nnaturale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Gravitatea  <\/span>\u0219i  <\/span>probabilitatea  <\/span>acestor <\/span>impacturi\n <\/span><\/span>ar  <\/span>trebui \n<\/span>evaluate  <\/span>\u0219i  <\/span>comparate \n<\/span>cu  <\/span>evalu\u0103rile riscurilor existente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceast\u0103 <\/span>compara\u021bie <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>contribuie <\/span>la <\/span>stabilirea <\/span>priorit\u0103\u021bilor <\/span>\u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te <\/span>ac\u021biunile, alocarea res<\/span>urselor \u0219i \u00eembun\u0103t\u0103\u021birea planific\u0103rii\nr\u0103spunsului.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Informa\u021biile privind evenimentele adverse sunt fu<\/span>rnizate personalului autorizat \u0219i\ninstrumentelor.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Informa\u021biile  <\/span><\/span>privind  <\/span><\/span>evenimentele\n <\/span><\/span>adverse\n <\/span><\/span>trebuie\n <\/span><\/span>transmise\n <\/span><\/span>prompt\n <\/span><\/span>personalului\n <\/span><\/span>\u0219i\n <\/span><\/span>sistemelor\nautorizate, p<\/span>entru a permite\ndetec\u021bia, investigarea \u0219i r\u0103spunsul \u00een timp util.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 informa\u021biile despre evenimentele adverse sunt\ntransmise <\/span>prompt <\/span>persoanelor <\/span>\u0219i <\/span>sistemelor <\/span>potrivite, <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>s\u0103 <\/span>poat\u0103 <\/span>fi <\/span>luate <\/span>m\u0103suri <\/span>adecvate <\/span>f\u0103r\u0103 \u00eent\u00e2rziere. <\/span>A<\/span>ceasta <\/span>permite <\/span>detec\u021bia, <\/span>investigarea <\/span>\u0219i <\/span>r\u0103spunsul mai <\/span>rapid <\/span>la\npoten\u021biale <\/span>amenin\u021b\u0103ri <\/span>sau perturb\u0103ri.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>ipuri de ev<\/span>enimente adverse<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Includerea  <\/span><\/span>indicatorilor  <\/span><\/span>precum  <\/span><\/span>acti<\/span>vit\u0103\u021bi  <\/span><\/span>neobi\u0219nuite  <\/span><\/span>ale  <\/span><\/span>contului,\n <\/span><\/span>acces\n <\/span><\/span>neautorizat,\nmodific\u0103ri ale configura\u021b<\/span>iei\nsistemului, \u00eenc\u0103lc\u0103ri ale securit\u0103\u021bii fizice sau alerte de malware.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Detec\u021bia \u0219i alertarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Utilizarea <\/span>instrumentelor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>pentru <\/span>a <\/span>detecta\n<\/span>astfel <\/span>de <\/span>evenim<\/span>ente <\/span>\u0219i pentru alertarea automat\u0103 a\npersonalului autorizat (de exemplu, anali\u0219ti SOC, personal de r\u0103spuns la\nincidente).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu sistemele de ticketing<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Alertele <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>integrate <\/span>cu <\/span>sistemul <\/span>de <\/span>ti<\/span>cketing <\/span>al <\/span>or<\/span>ganiza\u021biei. <\/span>Biletele <\/span>ar <\/span>trebui <\/span>s<\/span>\u0103 fie:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>generate\nautomat pentru tipurile de alerte predefinite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>create\nmanual atunci c\u00e2nd personalul tehnic identific\u0103 activit\u0103\u021bi suspecte.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Acces la jurnale \u0219i analize<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Personalul <\/span>autorizat <\/span>trebuie\n<\/span>s\u0103 <\/span>aib\u0103 <\/span>acces\n<\/span>continuu <\/span>la <\/span>datele\n<\/span>din <\/span>jurnale <\/span>\u0219i <\/span>la <\/span>rezultatele analizelor pentru sprijinirea\ninvestiga\u021biilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Evaluarea maturit\u0103\u021bii \u0219i eficacit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Evaluarea\nimplement\u0103rii controlului verific\u00e2nd:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Documenta\u021bia\n <\/span><\/span>procedurilor\n <\/span><\/span>de\n <\/span><\/span>generare,\n <\/span><\/span>revizu<\/span>ire  <\/span><\/span>\u0219i  <\/span><\/span>escaladare  <\/span><\/span>a  <\/span><\/span>alertelor<\/span>. <\/span>Aceast\u0103\ndocumenta\u021bie ar trebui revizuit\u0103 \u0219i actualizat\u0103 periodic.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Utilizarea\nautomatiz\u0103rii pentru alertele standard, cu procese manuale ca rezerv\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Controalele <\/span>de <\/span>acces <\/span>pentru <\/span>alerte <\/span>\u0219i <\/span>jurnale, <\/span>cu <\/span>revizuiri <\/span>periodice <\/span>ale <\/span>permisiunilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(accesul\nla alerte \u0219i jurnale trebuie s\u0103 fie limitat la personalul autorizat).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Monitorizarea <\/span>\u0219i <\/span>raportarea <\/span>ar <\/span>trebui, <\/span>de <\/span>exemplu, <\/span>s\u0103 <\/span>urm\u0103reasc\u0103 <\/span>num\u0103rul\n<\/span>de <\/span>alerte, <\/span>timpii de r\u0103spuns \u0219i dac\u0103 procedurile\nsunt respectate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Personalul  <\/span>responsabil \n<\/span>cu  <\/span>gestionarea  <\/span>alertelor \n<\/span>ar  <\/span>trebui  <\/span>s\u0103 \n<\/span>beneficieze  <\/span>de  <\/span>instruire periodic\u0103, pentru a asigura c\u0103\n\u00een\u021belege cum s\u0103 interpreteze alertele \u0219i s\u0103 ac\u021bionez<\/span>e \u00ee<\/span>n consecin\u021b\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

DE.AE-08<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Incidentele <\/span>sunt <\/span>declarate <\/span>atunci <\/span>c\u00e2nd <\/span>evenimentele <\/span>adverse <\/span>\u00eendeplines<\/span>c <\/span>criteriile <\/span>definite\n<\/span>pentru incidente.<\/span><\/p>\n\n

DE.AE-08.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Incidentele  <\/span>trebuie  <\/span><\/span>raportate  <\/span>atunci \n<\/span>c\u00e2nd  <\/span>evenimentele  <\/span>adverse \n<\/span>\u00eendeplinesc  <\/span>criteriile  <\/span>definite \n<\/span>\u0219i documentate pentru incidente.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest Control asigur\u0103\nidentificarea \u0219i raportarea evenimentelor adverse atunci c\u00e2nd acestea\n\u00eendeplinesc criterii de incident cl<\/span>ar\ndefinite \u0219i <\/span>documentate. Aceasta\nsubliniaz\u0103 importan\u021ba existen\u021bei unor <\/span>praguri\n\u0219i <\/span>linii <\/span>directoare <\/span>consecvente <\/span>pentru <\/span>a <\/span>determina\n<\/span>momentul <\/span>\u00een <\/span>care <\/span>un\neveniment <\/span>se calific\u0103 drept incident,\nsprijinind con\u0219tientizarea \u00een timp util \u0219i escaladarea sau r\u0103spun<\/span>sul adecvat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Criteriile <\/span>privind <\/span>incidentele <\/span>(regulile\n<\/span>care <\/span>definesc <\/span>ce <\/span>se <\/span>calific\u0103\n<\/span>drept <\/span>incident) <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie\nclar definite, documentate \u0219i revizuite periodic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste <\/span>crite<\/span>rii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>contribuie <\/span>la <\/span>determinarea <\/span>momentului <\/span>\u00een <\/span>care <\/span>un <\/span>eveniment <\/span>advers devine un incident care trebuie\nraportat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Criteriile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>fundamentate <\/span>pe <\/span>tiparele <\/span>cunoscute\n<\/span>de <\/span>activitate normal\u0103 <\/span>\u0219i <\/span>anormal\u0103,\ninclusiv pe lec\u021biile \u00eenv\u0103\u021bate din incidentele anterioare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>La stabilirea criteriilor<\/span>, trebuie luate \u00een considerare falsele\npozitive cunoscute, pentru evitarea raport\u0103rilor i<\/span>nutile.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Atunci <\/span>c\u00e2nd <\/span>un <\/span>eveniment\n<\/span>\u00eendepline\u0219te <\/span>criteriile\ndefinite, <\/span>acesta <\/span>ar <\/span>trebui <\/span>tratat <\/span>ca <\/span>un <\/span>incident <\/span>\u0219i raportat \u00een conformitate cu procedurile\nor<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Atunci <\/span>c\u00e2nd <\/span>este <\/span>cazul\n<\/span>\u0219i <\/span>acolo <\/span>unde <\/span>este <\/span>fezabil,\n<\/span>sistemele <\/span>ar <\/span>trebui\n<\/span>configurate <\/span>pentru <\/span>sprijinirea acestui <\/span>proc<\/span>es <\/span>prin <\/span>generarea <\/span>de <\/span>alerte <\/span>atunci <\/span>c\u00e2nd <\/span>sunt <\/span>\u00eendeplinite <\/span>criteriile <\/span>de <\/span>incident. <\/span>Aceasta poate contribui la detec\u021bia mai\nrapid\u0103 a incidentelor<\/span>, \u00een special \u00een\nmedii mai mari sau mai complexe.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

R\u0102SPUNS<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

[RS.MA]\nMANAGEMENTUL INCIDENTELOR<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

R\u0103spunsurile la incidentele de securitate cibernetic\u0103\ndetectate sunt gestionate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

IRP-ul este <\/span>executat\n\u00ee<\/span>n coordonare c<\/span>u p\u0103r\u021bile ter\u021be relevante odat\u0103 ce un incident este declarat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Un <\/span>IRP, <\/span>care <\/span>include\n<\/span>rolurile, <\/span>respon<\/span>sabilit\u0103\u021bile <\/span>\u0219i <\/span>atribu\u021biile <\/span>de <\/span>autoritate <\/span>definite,\n<\/span>trebuie <\/span>executat <\/span>\u00een timpul sau dup\u0103 un eveniment de\nsecuritate <\/span>cibernetic\u0103 care afecteaz\u0103\nsistemele critice ale organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a asigura\n<\/span>executarea <\/span>unui <\/span>IRP <\/span>bine <\/span>definit <\/span>\u00een <\/span>timpul <\/span>sau <\/span>dup\u0103 <\/span>un\neveniment de securitate cibernetic\u0103 care afecteaz\u0103 sistemele critice ale <\/span>organiza\u021biei, permi\u021b\u00e2nd detec\u021bia,\nlimitarea, comunicarea \u0219i recuperarea \u00een timp util.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Elaborarea unui plan de r\u0103spuns documentat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>includ\u0103 <\/span>instruc\u021biuni <\/span>\u0219i <\/span>proceduri <\/span>pre<\/span>definite <\/span>pentru\n<\/span>detec\u021bia <\/span>incidentelor <\/span>de securitate cibernetic\u0103, pentru a r\u0103sp<\/span>unde \u00een mod eficace \u0219i pentru a sprijini\nrecu<\/span>perarea sistemelor critice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea unor capabilit<\/span>\u0103\u021bi de detec\u021bie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>s\u0103 <\/span>existe <\/span>tehnologii\n<\/span>de <\/span>detec\u021bie <\/span>care <\/span>s\u0103 <\/span>raporteze\n<\/span>automat <\/span>incidentele <\/span>confirmate\n<\/span>\u0219i s\u0103 declan\u0219eze ac\u021biuni de r\u0103spuns.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea rolurilor<\/span>,\nresponsabilit\u0103\u021bilor \u0219i atribu\u021biilor de autoritate<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul\nar tre<\/span>bui s\u0103 identifice \u00een mod clar:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Cine\neste implicat \u00een r\u0103spuns.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Datele\nde contact ale personalului cheie.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Cine\nare autoritatea de a ini\u021bia recup<\/span>erarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Cine  <\/span> <\/span><\/span>este \n<\/span> <\/span><\/span>responsabil  <\/span> <\/span><\/span>pentru \n<\/span> <\/span><\/span>comunicarea   <\/span>extern\u0103 \n<\/span> <\/span><\/span>(de \n<\/span> <\/span><\/span>exemplu,  <\/span> <\/span><\/span>autorit\u0103\u021bile  <\/span> <\/span><\/span>de reglementare, partenerii, mass<\/span>-media).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea \u0219i actualizarea periodic\u0103 a planului<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul <\/span>ar <\/span>tr<\/span>ebui <\/span>r<\/span>evizuit <\/span>\u0219i <\/span>actualizat <\/span>pentru\n<\/span>re<\/span>flectarea <\/span>modific\u0103rilor <\/span>survenite <\/span>\u00een <\/span>peisajul amenin\u021b\u0103rilor<\/span>, structura or<\/span>ganiza\u021b<\/span>ional\u0103 sau\nlec\u021biile \u00eenv\u0103\u021bate din incidentele anterioare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea planului prin exerci\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>efectuate <\/span>simul\u0103ri <\/span>\u0219i <\/span>exerci\u021bii <\/span>teoretice <\/span>pen<\/span>tru <\/span>validarea <\/span>eficacit\u0103\u021bii <\/span>planului <\/span>\u0219i\nidentificarea domeniilor care necesit\u0103 \u00eembun\u0103t\u0103\u021biri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea mediilor OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>abordeze <\/span>r\u0103spunsul <\/span>la <\/span>incidente <\/span>\u00een <\/span>sistemele <\/span>OT<\/span>, <\/span>inclusiv <\/span>coordonarea <\/span>cu protocoalele de siguran\u021b\u0103, izolarea\nactivelor in<\/span>dustriale afectate \u0219i\nrestabilirea proceselor opera\u021bionale<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>coordoneze <\/span>ac\u021biunile <\/span>de <\/span>r\u0103spuns\n<\/span>la <\/span>incidentele <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a informa\u021biei cu\ntoate p\u0103r\u021bile interesate predefinite.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>toate <\/span>p\u0103r\u021bile\n<\/span>interesate <\/span>interne <\/span>\u0219i <\/span>externe <\/span>relevante colaboreaz\u0103 \u00een mod eficace \u00een\ntimpul unui incident de securitate cibernetic\u0103 sau a informa\u021biei.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een consid<\/span>erare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ac\u021biunile de r\u0103spuns la incidente ar\ntrebui coordonate cu p\u0103r\u021bile interesate predefinite, inclusiv conducerea <\/span>or<\/span>ganiza\u021biei<\/span>, <\/span>responsabilii <\/span>de <\/span>sisteme <\/span>IT \u0219i <\/span>OT<\/span>, <\/span>echipele <\/span>de <\/span>securitate <\/span>cibernetic\u0103, v\u00e2nz\u0103torii<\/span>, departamentul de resurse umane,\ndepartamentul juridic, departamentul de securitate fizic\u0103, departamentul de\nopera\u021biuni \u0219i departamentul de achizi\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Coordonarea ar trebui s\u0103 respecte IRP-urile <\/span>doc<\/span>umentate\nale or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Pentru <\/span>fiecare <\/span>incident <\/span>ar <\/span>trebui <\/span>desemnat\u0103\n<\/span>o <\/span>per<\/span>soan\u0103 <\/span>respo<\/span>nsabil\u0103\n<\/span>care <\/span>s\u0103 <\/span>gestioneze <\/span>r\u0103spunsul\n\u0219i s\u0103 asigure o comunicare clar\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dac\u0103 este necesar<\/span>, ar tr<\/span>ebui\nactivate planuri suplimentare, precum continuitatea activit\u0103\u021bii sau recuperarea\n\u00een caz de dezastru, pentru sprijinirea r\u0103spunsului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Informa\u021biile <\/span>ar <\/span>trebui <\/span>comunicate <\/span>persoanelor <\/span>potrivite <\/span>la momentul <\/span>potrivit, <\/span>urm\u00e2nd\nprocedurile de comunicare stabilite.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Diferitele tipuri de incidente ar trebu<\/span>i recunoscute \u0219i gestionate \u00een mod\ncorespunz\u0103tor:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Incidente\nle<\/span>gate de informa\u021bii (de ex<\/span>emplu, <\/span>expunerea\naccidental\u0103 a datelor).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Incidente\nde securitate cibernetic\u0103 (de exemplu, programe malware, piraterie\ninformatic\u0103).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Incidente\nO<\/span>T\n<\/span>(de exemplu, \u00eentreruperi ale ICS).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Incidentele <\/span>OT <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>implice <\/span>personal <\/span>OT specializat <\/span>\u0219i <\/span>pot <\/span>necesita <\/span>procedu<\/span>ri <\/span>de <\/span>r\u0103spuns diferite pentru protejarea\nsiguran\u021bei \u0219i opera\u021biunilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rapoartele privind incidentele sunt triate \u0219i\nvalidate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Rapoartele <\/span>privind <\/span>incidentele <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>trebuie <\/span>triate <\/span>\u0219i <\/span>validate <\/span>\u00een conformitate cu procedurile de r\u0103spuns\nla incidente ale organiza\u021biei.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>toate <\/span>incidentele <\/span>raportate <\/span>sunt <\/span>revizuite <\/span>\u0219i <\/span>evaluate <\/span>\u00een mod\n<\/span>sistematic <\/span>\u00eenainte <\/span>de <\/span>a <\/span>se <\/span>lua <\/span>orice <\/span>alt\u0103 <\/span>m\u0103sur\u0103.\n<\/span>Acest <\/span>Co<\/span>ntrol <\/span>este <\/span>un <\/span>pas <\/span>fundamental <\/span>\u00een <\/span>procesul de r\u0103spuns\nla incidente \u0219i ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Filtrarea rapoartelor irelevante sau false<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Nu <\/span>toate <\/span>ra<\/span>poartele <\/span>pri<\/span>mite <\/span>reprezi<\/span>nt\u0103 <\/span>incidente\n<\/span>reale. <\/span>Acest <\/span>Control\n<\/span>asigur\u0103 <\/span>c\u0103 <\/span>sunt <\/span>luate\nm\u0103suri numai \u00een cazul incide<\/span>ntelor\nlegitime, relevante pentru securitatea cibernetic\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea unui r\u0103spuns prompt \u0219i adecvat<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Prin <\/span>trierea <\/span>\u0219i <\/span>validarea <\/span>timpurie <\/span>a <\/span>rapoartelor<\/span>, <\/span>or<\/span>ganiza\u021biile <\/span>pot <\/span>prioritiza <\/span>amenin\u021b\u0103rile <\/span>reale \u0219i pot evita risipa de resurse pentru <\/span>probleme neimportante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Sprijinirea unui proces decizional consecvent<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aplicarea <\/span>unor <\/span>criterii <\/span>structurate <\/span>de <\/span>triere <\/span>\u0219i <\/span>validare <\/span>contribuie\n<\/span>la <\/span>asigurarea <\/span>unui <\/span>r\u0103spuns\nconsecvent, repetabil \u0219i aliniat la politicile or<\/span>ganiz<\/span>a\u021biei \u00een cazul\nincidentelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Permiterea escalad\u0103rii \u0219i cla<\/span>sific\u0103rii eficiente<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>alidarea <\/span>este <\/span>o <\/span>condi\u021bie <\/span>prealabil\u0103 <\/span>pentru <\/span>clasificarea <\/span>\u0219i <\/span>escaladarea <\/span>incidentelor <\/span>(conform cerin\u021belor <\/span>din <\/span>RS.MA-03.1). <\/span>F\u0103r\u0103 aceasta, <\/span>procesul <\/span>de <\/span>r\u0103spuns <\/span>ar <\/span>putea <\/span>fi <\/span>direc\u021bionat <\/span>gre\u0219it sau \u00eent\u00e2rziat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cembun\u0103t\u0103\u021birea con\u0219tientiz\u0103rii situa\u021bionale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>V<\/span>alidarea <\/span>timpurie <\/span>contribuie\n<\/span>la <\/span>construirea <\/span>unei <\/span>imagini <\/span>mai <\/span>clare <\/span>a <\/span>peisajului <\/span>amenin\u021b\u0103rilor \u0219i sprijin\u0103 o <\/span>mai bun\u0103 coordonare \u00eentre echipe.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>utilizate <\/span>instrumente <\/span>automatizate <\/span>pentru  <\/span><\/span>sprijinirea <\/span>investig\u0103rii <\/span>\u0219i <\/span>evalu\u0103rii\n<\/span>impactului incidentelor de securitate cibernetic\u0103 validate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>organiza\u021biile <\/span>dispun <\/span>de <\/span>capabilit\u0103\u021bile <\/span>te<\/span>hnice <\/span>necesare pentru gestionarea \u00een mod eficien<\/span>t \u0219i precis a incidentelor de securitate\ncibernetic\u0103 odat\u0103 ce acestea au fost validate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instrumentele automatizate ar trebui\ns\u0103 contribuie la colectarea, <\/span>analizarea\n\u0219i corelarea datelor privind incidentele, pentru sprijinirea investig\u0103rii\nprompte \u0219i precise a ace<\/span>stora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Aceste <\/span>instrumente <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>contribuie <\/span>la <\/span>identificarea <\/span>amplorii,\n<\/span>gravit\u0103\u021bii <\/span>\u0219i <\/span>impactului poten\u021bial al incidentelor care\nau fost valida<\/span>te <\/span>prin triere. Un incident validat <\/span>este unul care a fost confirmat ca fiind\nlegat de securitatea cibernetic\u0103 (nu este o alarm\u0103 fals\u0103 sau o problem\u0103 tehnic\u0103\nf\u0103r\u0103 leg\u0103tur\u0103), \u00eendepline\u0219te criteriile de gravitate predefinite (precum IoC<\/span>-uri, informa\u021bii privind amenin\u021b\u0103rile <\/span>sau <\/span>tipare <\/span>de <\/span>atac <\/span>cunoscute) <\/span>\u0219i <\/span>necesit\u0103 <\/span>ac\u021biuni\n<\/span>de <\/span>r\u0103spuns <\/span>(adic\u0103 <\/span>\u00eendepline\u0219te <\/span>pragul pentru investiga\u021bii suplimentare,\nclasificare \u0219i escaladare).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Pentru sus\u021binerea acestor activit\u0103\u021bi pot fi luate \u00een\nconsiderare <\/span>urm\u0103toarele tipuri de inst<\/span>rumente:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sisteme\nSIE<\/span>M pentru colectarea \u0219i analiza\ncentralizat\u0103 a jurnalelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>XDR <\/span>pentru <\/span>detec\u021bia <\/span>integrat\u0103\n<\/span>a <\/span>amenin\u021b\u0103rilor <\/span>la <\/span>nivelul <\/span>endpoint<\/span>-urilor<\/span>, <\/span>re\u021belelor <\/span>\u0219i <\/span>serverelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>SOAR\npentru automatizarea fluxurilor de lucru \u0219i coordonarea ac\u021biunilor de r\u0103sp<\/span>uns.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Platforme <\/span>de <\/span>informa\u021bii <\/span>privind <\/span>amenin\u021b\u0103rile <\/span>pentru <\/span>\u00eembog\u0103\u021birea <\/span>datelor\n<\/span>privind <\/span>incidentele cu\ncontextul amenin\u021b\u0103rilor externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistem <\/span>de <\/span>detec\u021bie <\/span>a <\/span>intruziunilor <\/span>\u00een <\/span>re\u021bea <\/span>(NIDS) <\/span>pentru <\/span>monitorizarea <\/span>\u0219i <\/span>alertarea <\/span>cu <\/span>privire\nla activit\u0103\u021bi suspecte \u00een r<\/span>e<\/span>\u021bea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Centre <\/span>de <\/span>r\u0103spuns <\/span>la <\/span>incidente\n<\/span>informatice <\/span>(CIRC) <\/span>pentru <\/span>coordonare <\/span>centralizat\u0103 <\/span>\u0219i <\/span>analiz\u0103 de\nspecialitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Mecanismele <\/span>automatizate <\/span>ar <\/span>trebui\n<\/span>integr<\/span>ate <\/span>\u00een <\/span>procesul <\/span>de <\/span>r\u0103<\/span>spuns <\/span>la <\/span>incidente <\/span>pentru <\/span>a <\/span>asigura c\u0103 <\/span>incidentele <\/span>validate <\/span>sunt <\/span>investigate <\/span>\u00een <\/span>mod <\/span>eficient\n<\/span>\u0219i <\/span>prioritizate \u00een <\/span>mod <\/span>corespunz\u0103tor<\/span>, <\/span>\u00een\nconformitate cu IRP-ul or<\/span>ganiza\u021biei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Incidentele sunt clasificate \u0219i prioritizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Incidentele <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei <\/span>trebuie <\/span>clasificate, <\/span>prioritizate <\/span>\u0219i <\/span>esc<\/span>aladate conform <\/span>IRP-ului.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Acest Control este o\nevolu\u021bie a RS.MA<\/span>-02.1 \u0219i are scopul\nde a asigura c\u0103, odat\u0103 ce un incident este validat, acesta este clasificat \u0219i\ngestionat \u00een mod sistematic \u00een func\u021bie de natura, urgen\u021ba \u0219i impactul poten\u021bial <\/span>al <\/span>acestuia, <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>organiza\u021bia <\/span>s\u0103 <\/span>poat\u0103 <\/span>r\u0103spunde\n<\/span>\u00een <\/span>mod <\/span>eficace, <\/span>consecvent <\/span>\u0219i <\/span>adecvat.\n\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare\nurm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Incidentele <\/span>ar <\/span>trebui <\/span>revizuite <\/span>\u0219i <\/span>clasificate <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>tipul <\/span>lor  <\/span><\/span>(de\n<\/span>exemplu, <\/span>\u00eenc\u0103lcarea\nsecurit\u0103\u021bii datelor<\/span>, rans<\/span>omware, D<\/span>DoS,\ncompromiterea contului) \u0219i de amploarea validat\u0103 <\/span>a impactului lor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Estimarea <\/span>\u0219i <\/span>validarea\n<\/span>amplorii <\/span>unui <\/span>incident\n<\/span>– <\/span>dezvoltat\u0103 <\/span>\u00een <\/span>continuare <\/span>\u00een <\/span>RS.AN-08.1 <\/span>(Esen\u021bial)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

–\nar trebui s\u0103 informeze modul \u00een care incidentele sunt clasificate \u0219i\nprioritizate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Indicatori precum domeniul de\naplicare, gravitatea \u0219i sensibilitatea la fac<\/span>torul\ntimp ar trebui s\u0103 ghideze deciziile privind stabilirea priorit\u0103\u021bilor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>SBOM-urile pot sprijini evaluarea\nimpactului pri<\/span>n identificarea\ncomponentelor \u0219i dependen\u021belor afectate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Criteriile <\/span>de <\/span>clasificare, <\/span>prioritizare <\/span>\u0219i <\/span>escaladare <\/span>ar <\/span>trebui <\/span>documentate <\/span>\u00een <\/span>IRP <\/span>\u0219i <\/span>aplicate <\/span>\u00een <\/span>mod\nconsecvent.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Strategiile <\/span>de <\/span>r\u0103spuns <\/span>la incidente <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>echilibreze <\/span>necesitatea <\/span>unei <\/span>recuper<\/span>\u0103ri <\/span>rapide <\/span>cu poten\u021bialele beneficii ale observ\u0103rii\ncomportamentului atacatorului sau ale efectu\u0103rii unei investiga\u021bii <\/span>mai <\/span>aprofundate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Procedurile de escaladare ar trebui\ncoordonate cu p\u0103r\u021bile interesate interne \u0219i externe desemnate pentru asigurarea\nunui <\/span>r\u0103<\/span>spuns oportun \u0219i adecva<\/span>t.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.MA-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Se\n<\/span>aplic\u0103 <\/span>criterii <\/span>pentru\n<\/span>ini\u021bierea <\/span>activit\u0103\u021bilor <\/span>de <\/span>recuperare <\/span>\u00een <\/span>urma <\/span>unui <\/span>incident <\/span>de <\/span>securitate\ncibernetic\u0103.<\/span><\/p>\n\n

RS.MA-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>definite <\/span>\u0219i <\/span>aplicate\n<\/span>criterii <\/span>clare <\/span>pentru <\/span>determinarea <\/span>momentului <\/span>\u00een <\/span>care <\/span>trebuie\n<\/span>ini\u021biate procesele de recuperare \u00een urma incidentelor.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>orga<\/span>niza\u021biile <\/span>dispun <\/span>de <\/span>un <\/span>proces <\/span>decizional\nclar, consecvent \u0219i bazat pe risc pentru determinarea momentului \u00een care treb<\/span>ui<\/span>e\ns\u0103 \u00eenceap\u0103 ac\u021biunile de recuperare \u00een urma unui incident de securitate\ncibernetic\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Criteriile <\/span>pentru <\/span>ini\u021bierea <\/span>recuper\u0103rii <\/span>\u00een <\/span>urma <\/span>unui <\/span>incident <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>bazate\n<\/span>pe <\/span>caracteristicile cunoscute\nsau presupuse ale incidentului, precum gravitatea, amploarea \u0219i impactul s\u0103u\npoten\u021bial asupra opera\u021biunilor<\/span>, datelor\nsau sistemelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Decizia <\/span>de <\/span>a <\/span>\u00eencepe\n<\/span>re<\/span>cuperarea <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>\u021bin\u0103 <\/span>cont <\/span>\u0219i <\/span>de <\/span>poten\u021bialele <\/span>perturb\u0103ri <\/span>pe <\/span>care activit\u0103\u021bile\nde recuperare <\/span>le pot cauza\nopera\u021biunilor \u00een curs.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>RPO \u0219i <\/span>R<\/span>T<\/span>O ar trebui incluse \u00een criterii pentru a asigura\nc\u0103 ac\u021biunile de recuperare sunt \u00een concordan\u021b\u0103 cu cerin\u021bele de continuitate a\nactivit\u0103\u021bii \u0219i cu pragurile acceptabile de \u00eentrerupere a activit\u0103\u021bii sau de\npierdere a datelor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[RS.AN]\nANALIZA INCIDENTELOR<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Sunt\n<\/span>efectuate <\/span>investiga\u021bii <\/span>pentru <\/span>asigurarea <\/span>unui <\/span>r\u0103spuns <\/span>eficace <\/span>\u0219i <\/span>pentru <\/span>sprijinirea <\/span>activit\u0103\u021bilor <\/span>de analiz\u0103 criminalistic\u0103 \u0219i recuperare.<\/span><\/p>\n\n

RS.AN-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Se <\/span>efectueaz\u0103 <\/span>analize <\/span>pentru <\/span>a <\/span>st<\/span>abili <\/span>ce <\/span>s-a <\/span>\u00eent\u00e2mplat <\/span>\u00een <\/span>timpul <\/span>unui <\/span>incident <\/span>\u0219i <\/span>cauza <\/span>principal\u0103\n<\/span>a incidentului.<\/span><\/p>\n\n

RS.AN-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Fiecare <\/span>incident <\/span>trebuie <\/span>analizat\n<\/span>pentru <\/span>a <\/span>determina <\/span>ce <\/span>s<\/span>-a <\/span>\u00eent\u00e2mplat <\/span>\u0219i <\/span>pentru <\/span>a <\/span>identifica <\/span>cauza principal\u0103 <\/span>a <\/span>acestuia.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>\u00een\u021belege\n<\/span>amploarea <\/span>unui <\/span>incident\n<\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>\u0219i <\/span>de <\/span>a identifica <\/span>cauza <\/span>sa <\/span>principal\u0103, <\/span>permi\u021b\u00e2nd <\/span>un <\/span>r\u0103spuns <\/span>eficace\n\u0219i <\/span>prevenirea <\/span>unor <\/span>evenimente similare\n\u00een viitor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een c<\/span>onsiderare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Secven\u021ba <\/span>evenimentelor <\/span>din <\/span>timpul <\/span>incidentului <\/span>ar <\/span>trebui <\/span>reconstituit\u0103, <\/span>identific\u00e2nd <\/span>sistemele,\nactivele \u0219i resursele implicate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar <\/span>trebui <\/span>identificate <\/span>vulnerabilit\u0103\u021bile, <\/span>amenin\u021b\u0103rile <\/span>\u0219i <\/span>actorii <\/span>de <\/span>amenin\u021bare <\/span>lega\u021bi <\/span>de <\/span>incident, indiferent dac\u0103 sunt implica<\/span>\u021bi direct sau indirect.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Analiza <\/span>criminalistic\u0103 <\/span>ar <\/span>trebui <\/span>utilizat\u0103\n<\/span>atunci <\/span>c\u00e2nd <\/span>este <\/span>necesar <\/span>pentru <\/span>examinarea <\/span>datelor colectate \u0219i determinarea cauzei\nprincipale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Analiza <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>se <\/span>concentreze <\/span>pe <\/span>identificarea <\/span>cauzelor <\/span>sistem<\/span>ice <\/span>subiacente, <\/span>nu <\/span>doar <\/span>pe factorii declan\u0219atori imedia\u021bi.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>ehnologiile <\/span>de <\/span>decep\u021bie\n<\/span>cibernetic\u0103 <\/span>ar <\/span>trebui <\/span>rev<\/span>izuite <\/span>pentru <\/span>a <\/span>ob\u021bine <\/span>informa\u021bii <\/span>suplimentare despre comportamentul atacatorilor<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.AN-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Ac\u021biunile <\/span>\u00eentreprinse <\/span>\u00een <\/span>timpul <\/span>unei <\/span>investiga\u021bii <\/span>sunt <\/span>\u00eenregistrate, <\/span>iar <\/span>integritatea <\/span>\u0219i <\/span>provenien\u021ba\n\u00eenregistr\u0103rilor sunt p\u0103strate.<\/span><\/p>\n\n

RS.AN-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Ac\u021biunile <\/span>\u00eentreprinse <\/span>\u00een <\/span>timpul <\/span>unei <\/span>investiga\u021bii <\/span>trebuie <\/span>\u00eenregistrate, <\/span>iar <\/span>integritatea <\/span>\u0219i <\/span>provenien\u021ba\n\u00eenregistr\u0103rilor trebuie p\u0103strate.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 <\/span>toate ac\u021biunile\n\u00eentreprinse \u00een timpul unei investiga\u021bii a incidentului sunt \u00eenregistrate <\/span>corespunz\u0103tor \u0219i c\u0103 integritatea \u0219i <\/span>provenien\u021ba <\/span>acestor <\/span>\u00eenregistr\u0103ri\nsunt protejate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui luate\n\u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Solicitarea <\/span>tuturor <\/span>membrilor <\/span>personalului <\/span>implica\u021bi <\/span>\u00een <\/span>r\u0103spunsul <\/span>la <\/span>incidente <\/span>(de <\/span>exemplu,\npersonal de r\u0103spuns la incidente, administratorii de sistem, inginerii) s\u0103 \u00ee\u0219i\njurnalizeze ac\u021biunile \u00eentr<\/span>-un mod\ncare s\u0103 \u00eempiedice modifi<\/span>carea sau \u0219te<\/span>r<\/span>gerea\nacestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Atribuirea <\/span>responsabilit<\/span>\u0103\u021bii <\/span>coordonatorului <\/span>de r\u0103spuns <\/span>la <\/span>incidente\n<\/span>pentru <\/span>documentarea <\/span>\u00eentregii investiga\u021bii, inclusiv\ncronologia, deciziile \u0219i sursele de informa\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Asigurarea faptului c\u0103 toate\n\u00eenregistr\u0103rile sunt stocate \u00een mod securizat \u0219i r\u0103m\u00e2n trasabile p\u00e2n\u0103 la sursa\nlor original\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.AN-07<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Datele \u0219i metadatele incidentului sunt colectate, iar\nin<\/span>tegritatea \u0219i provenien\u021ba acestora\nsunt p\u0103strate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.AN-07.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Datele  <\/span><\/span>\u0219i  <\/span><\/span>metadatele\n <\/span><\/span>incidentul<\/span>ui  <\/span><\/span>trebuie  <\/span><\/span>colectate  <\/span><\/span>\u0219i  <\/span><\/span>protejate\n <\/span><\/span>pentru\n <\/span><\/span>asigurarea\n <\/span><\/span>acurate\u021bei,\nautenticit\u0103\u021bii \u0219i trasabilit\u0103\u021bii acestora.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 toate informa\u021biile relevante despre un incident de\nsecuritate <\/span>cibernetic\u0103 <\/span>sunt <\/span>\u00ee<\/span>n<\/span>registrate <\/span>cu <\/span>acurate\u021be, <\/span>stocate\n<\/span>\u00een <\/span>mod <\/span>securiz<\/span>at <\/span>\u0219i <\/span>trasabile <\/span>\u00een <\/span>mod <\/span>fiabil<\/span>,\nastfel \u00eenc\u00e2t s\u0103 poat\u0103 fi utilizate <\/span>\u00een\nmod eficace \u00een scopuri de r\u0103spuns, investigare \u0219i legale sau de conformitate.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een co<\/span>nsiderare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Datele <\/span>\u0219i <\/span>metadatele <\/span>referitoare <\/span>la <\/span>incidente\n<\/span>(precum <\/span>sursa <\/span>datelor\n<\/span>\u0219i <\/span>momentul <\/span>colect\u0103rii <\/span>acestora)<\/span><\/p>\n\n

 <\/span><\/p>\n\n

ar\ntrebui colectate \u0219i stocate \u00eentr<\/span>-un\nmod care s\u0103 le protejeze \u00eempotriva falsific\u0103rii sau pierderii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integritatea \u0219i originea acest<\/span>or informa\u021bii ar treb<\/span>ui\np\u0103strate utiliz\u00e2nd metode precum:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Documenta\u021bia <\/span>lan\u021bului <\/span>de <\/span>custodie <\/span>pentru <\/span>urm\u0103<\/span>rirea <\/span>modului <\/span>\u00een <\/span>care <\/span>sunt <\/span>gestionate <\/span>datele,\n<\/span>de la colectare p\u00e2n\u0103 la analiz\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Semn\u0103turi  <\/span><\/span>digitale  <\/span><\/span>\u0219i  <\/span><\/span>criptare\n <\/span><\/span>pentru\n <\/span><\/span>prevenirea\n <\/span><\/span>accesului\n <\/span><\/span>neautorizat\n <\/span><\/span>\u0219i\n <\/span><\/span>confirmarea\nautenticit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Jurnale\nde audit pentru a \u00eenregistra cine a accesat sau modificat datele \u0219i c\u00e2nd.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Colectarea \u0219i protejarea acestor informa\u021bii ar treb<\/span>ui s\u0103 sprijine:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>R\u0103spunsul <\/span>prompt, <\/span>contribuind <\/span>la <\/span>\u00een\u021belegerea <\/span>momentului <\/span>\u0219i <\/span>a <\/span>modului\n<\/span>\u00een <\/span>care <\/span>s<\/span>-a <\/span>produs incidentul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Investigarea <\/span>\u0219i <\/span>analiza, <\/span>prin <\/span>furnizarea\n<\/span>de <\/span>detalii <\/span>fiabile <\/span>despre <\/span>cauza, <\/span>amploarea <\/span>\u0219i <\/span>impactul\nincidentului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Cerin\u021bele <\/span>legale <\/span>\u0219i <\/span>de <\/span>conformitate, <\/span>asigur\u00e2nd <\/span>c\u0103 <\/span>datele <\/span>pot <\/span>fi <\/span>utilizate <\/span>ca <\/span>probe, <\/span>dac\u0103 <\/span>este\nnecesar<\/span>.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.AN-08<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Amploarea <\/span>unui\nincident este estimat\u0103 \u0219i validat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.AN-08.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Amploarea unui incident trebuie estimat\u0103 \u0219i validat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>organiza\u021biile <\/span>au <\/span>o <\/span>\u00een\u021belegere <\/span>clar\u0103 <\/span>a <\/span>\u00eentregii\n<\/span>amplori <\/span>\u0219i a impactului unui\nincident de securitate cibernetic\u0103, astfel \u00eenc\u00e2t ac\u021biunile de r\u0103spun<\/span>s s\u0103 poat\u0103 fi dimensionate, prioritizate\n\u0219i coordonate \u00een mod adecvat.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Amploarea <\/span>\u0219i <\/span>impactul <\/span>unui <\/span>incident <\/span>ar <\/span>trebui <\/span>evaluate\n<\/span>prin <\/span>examinarea <\/span>nu <\/span>numai <\/span>a <\/span>sistemului\nafectat ini\u021bial, ci \u0219i a altor sisteme sau dispozitive care ar putea fi\ncompromise.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>IoC-urile <\/span>precum <\/span>activitatea <\/span>neobi\u0219nuit\u0103 <\/span>a <\/span>re\u021belei, <\/span>\u00eencerc\u0103rile <\/span>de <\/span>acces <\/span>neautorizat <\/span>sau <\/span>modific<\/span>\u0103rile nea\u0219teptate ale software-ului, ar tr<\/span>ebui identificate pentru a \u00een\u021b<\/span>elege c\u00e2t de mult s<\/span>-a r\u0103sp\u00e2ndit incidentul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Semnele de persisten\u021b\u0103, inclusiv\nbackdoor<\/span>-urile sau malware-ul care\npermit accesul continuu, ar trebui investigate pentru a determina dac\u0103 a<\/span>tacatorul r\u0103m\u00e2ne activ \u00een mediul respectiv<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar trebui utilizate instrumente automatizate\npentru scanarea IoC<\/span>-urilor \u0219i\nmecanismelor de persisten\u021b\u0103 \u00een toate activele poten\u021bial afectate, pentru\nsprijinirea unei analize prompte \u0219i aprofundate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Amploarea validat\u0103 a incidentului ar\ntrebui s\u0103 determine modul \u00een care incidentul este clasificat, prioritizat \u0219i\nescaladat, astfel cum este descris \u00een RS.MA<\/span>-03.1\n(Important), asigur\u00e2ndu-se c\u0103 ac\u021biunile de r\u0103spuns sunt aliniate cu riscul real\n\u0219i <\/span>impactul asupra activit\u0103\u021b<\/span>ii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[RS.CO]\nRAPORTAREA \u0218I COMUNICAREA R\u0102SPUNSULUI LA INCIDENTE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile <\/span>de <\/span>r\u0103spuns <\/span>sunt <\/span>coordonate <\/span>cu <\/span>p\u0103r\u021bile <\/span>interesate <\/span>interne <\/span>\u0219i <\/span>externe,\n<\/span>conform <\/span>cerin\u021belor legilor,\nreglement\u0103rilor sau politicilor.<\/span><\/p>\n\n

RS.CO-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

P\u0103r\u021bile interesate interne \u0219i externe sunt <\/span>informat<\/span>e\ncu privire la incidente.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.CO-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Informa\u021biile <\/span>privind <\/span>incidentele <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>trebuie <\/span>comunicate <\/span>angaja\u021bilor <\/span>\u00eentr<\/span>-un <\/span>mod clar \u0219i u\u0219or de \u00een\u021beles.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>to\u021bi <\/span>angaj<\/span>a\u021bii <\/span>sunt <\/span>informa\u021bi <\/span>\u00een <\/span>timp <\/span>util <\/span>\u0219i <\/span>\u00eentr-un\n<\/span>mod u\u0219or <\/span>de <\/span>\u00een\u021beles\n<\/span>cu <\/span>privire <\/span>la <\/span>incidentele <\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>astfel <\/span>\u00eenc\u00e2t <\/span>ace\u0219tia\n<\/span>s\u0103 <\/span>poat\u0103 <\/span>reac\u021biona \u00een mod adecvat \u0219i s\u0103 contribuie\nla reducerea riscurilor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar <\/span>trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>s\u0103 <\/span>existe\n<\/span>un <\/span>IRP<\/span>. <\/span>Acest <\/span>plan <\/span>descrie <\/span>modul\n<\/span>\u00een <\/span>care <\/span>or<\/span>ganiza\u021bia <\/span>va <\/span>r\u0103spunde <\/span>la <\/span>incidentele\nde <\/span>securitate <\/span>cibernetic\u0103, <\/span>inclusiv <\/span>cine <\/span>este <\/span>responsabil <\/span>pentru <\/span>ce <\/span>\u0219i <\/span>cum <\/span>se <\/span>vor <\/span>escalada\n<\/span>diferitele tipuri de amenin\u021b\u0103ri.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>IRP-ul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>un <\/span>protocol <\/span>de <\/span>comunicare <\/span>care <\/span>s\u0103 <\/span>explice\n<\/span>modul <\/span>\u00een <\/span>care <\/span>se <\/span>pot <\/span>partaja\nrapid \u0219i eficient informa\u021bii exacte \u0219i relevante cu angaja\u021bii \u00een timpul unui\nincident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Planul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>defineasc\u0103 <\/span>canalele\n<\/span>de <\/span>comunicare <\/span>care v<\/span>or <\/span>fi <\/span>utili<\/span>zate, <\/span>precu<\/span>m <\/span>e<\/span>-mailul, platformele interne de mesagerie,\napelurile telefonice <\/span>sau un portal\ndedicat incidentelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>\u0218abloanele <\/span>pentru <\/span>mesajele <\/span>privind\n<\/span>incidentele <\/span>ar <\/span>trebui <\/span>preg\u0103tite <\/span>\u00een <\/span>avans. <\/span>Aceste <\/span>\u0219abloane <\/span>ar trebui\n<\/span>s\u0103 <\/span>includ\u0103 <\/span>detalii\n<\/span>cheie, <\/span>pr<\/span>ecum <\/span>tipul <\/span>incidentului, <\/span>gravitatea <\/span>acestuia, s<\/span>istemele <\/span>afectate <\/span>\u0219i\nac\u021biunile pe care angaja\u021bii ar trebui s\u0103 le ia.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Mesajele <\/span>ar <\/span>trebui <\/span>redactate <\/span>\u00eentr<\/span>-un <\/span>li<\/span>mbaj <\/span>clar <\/span>\u0219i <\/span>simplu,\n<\/span>evit\u00e2nd <\/span>termenii <\/span>tehnici,\n<\/span>astfel <\/span>\u00eenc\u00e2t <\/span>to\u021bi angaja\u021bii s\u0103 \u00een\u021beleag\u0103 ce se <\/span>\u00eent\u00e2mpl\u0103 \u0219i ce se a\u0219teapt\u0103 de la ei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Conducerea superioar\u0103 ar trebui s\u0103 pri<\/span>measc\u0103 rezumate la nivel \u00eenalt care s\u0103\nexplice impactul incidentului, riscurile implicate \u0219i m\u0103surile luate pentru\nrezolvarea acestuia.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.CO-02.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Incidentele  <\/span>de \n<\/span>securitate  <\/span>ciberne<\/span>tic\u0103 \n<\/span>trebuie  <\/span>comunicate  <\/span>p\u0103r\u021bilor <\/span>interesate  <\/span>externe \n<\/span>relevante  <\/span>\u00een termenele definite\n\u00een IRP, inclusiv raportarea inci<\/span>dentelor\nsemnificative c\u0103tre autorit\u0103\u021bi, conform prevederilor legale.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>t<\/span>oate <\/span>p\u0103r\u021bile <\/span>externe\n<\/span>relevante <\/span>sunt <\/span>informate\n<\/span>cu <\/span>privire la incidentele de\nsecurit<\/span>ate cibernetic\u0103 \u00een timp util,\n\u00een mod securizat \u0219i adecvat, contribuind la men\u021binerea \u00eencrederii \u0219i la\n\u00eendeplinirea obli<\/span>ga\u021biilor legale \u0219i\ncontractuale.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Informa\u021biile <\/span>ar <\/span>trebui <\/span>partajate <\/span>\u00een <\/span>mod <\/span>securizat <\/span>\u0219i <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>IRP<\/span>-ul <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>cu orice acorduri\nde schimb de informa\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>P\u0103r\u021bile  <\/span>interesate \n<\/span>relevante  <\/span>pot  <\/span>include \n<\/span>roluri  <\/span><\/span>interne \n<\/span>desemnate,  <\/span>clien\u021bi  <\/span>afecta\u021bi, \n<\/span>furnizori, furnizori ter\u021bi de servicii \u0219i <\/span>parteneri ai or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Clien\u021bii <\/span>\u0219i <\/span>partenerii <\/span>ar <\/span>trebui <\/span>notifi<\/span>ca\u021bi <\/span>dac\u0103 <\/span>sunt <\/span>afecta\u021bi\n<\/span>de <\/span>un <\/span>incident, <\/span>cu <\/span>instruc\u021biuni <\/span>clare privind ac\u021biunile pe care ar trebui s\u0103 le \u00eentrepr<\/span>ind\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Comunicare<\/span>a cu p\u0103r\u021bile externe ar trebui s\u0103 respecte toate cerin\u021bele\ncontractuale sau acordurile \u00een vigoare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Comunicare<\/span>a  <\/span>de  <\/span>criz\u0103 \n<\/span>ar  <\/span>trebui  <\/span>coordonat\u0103 \n<\/span>cu  <\/span>furnizorii  <\/span>critici \n<\/span>pentru  <\/span>a  <\/span>asigura \n<\/span>coeren\u021ba mesajelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Atunci <\/span>c\u00e2nd <\/span>sunt <\/span>partajate <\/span>informa\u021bii <\/span>de<\/span>spre <\/span>tacticile <\/span>sau <\/span>tehnicile <\/span>atacatorilor<\/span>, <\/span>orice <\/span>date <\/span>sensibile\nsau de identificare ar treb<\/span>ui\neliminate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Departamentul  <\/span>de  <\/span>resurse  <\/span>umane \n<\/span>ar  <\/span>trebui  <\/span>informat \n<\/span>dac\u0103  <\/span>incidentul  <\/span>implic\u0103 \n<\/span>activit\u0103\u021bi  <\/span>r\u0103u inten\u021bionate din\npartea unei persoane din interior<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Conducerea <\/span>superioar\u0103 <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>primeasc\u0103\n<\/span>actualiz\u0103ri <\/span>periodice <\/span>cu <\/span>privire <\/span>la <\/span>starea <\/span>incidentelor majore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Autorit\u0103\u021bile <\/span>na\u021bionale, <\/span>precum <\/span>echipele\n<\/span>de <\/span>r\u0103spuns <\/span>la <\/span>incidente <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>(CSIR<\/span>T), autorit\u0103\u021bile <\/span>de <\/span>aplicare\na <\/span>legii <\/span>sau <\/span>autorit\u0103\u021bile <\/span>de <\/span>regle<\/span>mentare, <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>notificate <\/span>pe <\/span>baza\ncriteriilor definite \u00een IRP <\/span>\u0219i cu\naproba<\/span>rea conducerii superioare a or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>oate\n<\/span>raport\u0103rile <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>resp<\/span>ecte <\/span>legisla\u021bia <\/span>na\u021bional\u0103 \u0219i <\/span>european\u0103 <\/span>relevant\u0103, <\/span>precum Regulamentul de punere \u00een aplicare (U<\/span>E) 2024\/2690 al Comisiei din 17 octombrie\n2024 de stabilire <\/span>a <\/span>normelor\n<\/span>de aplicare <\/span>a <\/span>Directivei <\/span>(UE) <\/span>2022\/2555 <\/span>\u00een <\/span>ceea\nce <\/span>prive\u0219te <\/span>cerin\u021bele <\/span>tehnice<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

\u0219i metodologice ale\nm\u0103surilor de gestionare a riscurilor \u00een materie de securitate cibernetic\u0103 \u0219i\nspecificarea suplimentar\u0103 a cazurilor \u00een care un incident este considerat <\/span>semnificativ referitor la furnizorii <\/span>de <\/span>servicii <\/span>DNS, <\/span>registrele <\/span>de <\/span>nume\nTLD, <\/span>furnizorii <\/span>de <\/span>servic<\/span>ii <\/span>de <\/span>cloud <\/span>computing,\nfurnizorii de servicii de centre de date, furnizorii de re\u021bele de furni<\/span>zare de con\u021binut, furnizorii de servicii\ngestionate, furnizorii de servicii de securitate gestionate, furnizorii de\npie\u021be online, de motoare de c\u0103utare online \u0219i de platforme de servicii de\nsocializare \u00een re\u021bea, precum \u0219i prestatorii de servicii de \u00eencredere.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Actualiz\u0103rile <\/span>publice <\/span>privind\n<\/span>incidentele <\/span>sunt <\/span>tratate\n<\/span>\u00een <\/span>cadrul <\/span>unui <\/span>control <\/span>separat\n<\/span>(RC.CO<\/span>-04.1).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[RS.MI]\nATENUAREA INCIDENTELOR<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Sunt desf\u0103\u0219urate activit\u0103\u021bi pentru prevenirea\nextinderii unui eveniment \u0219i pentru a<\/span>-i\natenua efectele.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.MI-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Incidentele sunt limitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RS.MI-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Incidentele <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>trebuie <\/span>li<\/span>mitate\n<\/span>\u0219i <\/span>eliminate. <\/span>Orice\n<\/span>decizie <\/span>de <\/span>acceptare <\/span>\u0219i men\u021binere a <\/span>anumitor\nriscuri de securitate cibernetic\u0103 trebuie documentat\u0103 \u00een mod formal.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul aces<\/span>tui Control este de a opri r\u0103sp\u00e2ndirea\nincidentelor de securitate cibe<\/span>rnetic\u0103,\nde a elimina <\/span>cauza <\/span>acestora\n<\/span>\u0219i <\/span>de <\/span>a <\/span>se <\/span>asigura\n<\/span>c\u0103 <\/span>orice <\/span>ri<\/span>scuri <\/span>acceptate\n<\/span>sunt <\/span>\u00eenregistrate <\/span>\u0219i <\/span>aprobate <\/span>\u00een <\/span>mod\nclar.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een <\/span>considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar\n<\/span>trebui <\/span>s\u0103 <\/span>existe\n<\/span>un <\/span>proces <\/span>formal\n<\/span>de <\/span>acceptare <\/span>a <\/span>riscurilor <\/span>pentru\n<\/span>riscurile <\/span>de <\/span>securitate cibernetic\u0103 considerate a avea\nun impact redus \u0219i care nu amenin\u021b\u0103 sistemele critice pentru or<\/span>ganiza\u021bie. Aceste <\/span>riscuri <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>fie <\/span>revizuite <\/span>\u0219i <\/span>aprobate\n<\/span>de <\/span>persoana <\/span>sau <\/span>echipa\nresponsabil\u0103, pe baza toleran\u021bei la ris<\/span>c\na or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Instrumentele <\/span>de <\/span>securitate <\/span>cibernetic\u0103, <\/span>precum <\/span>software<\/span>-ul antivirus <\/span>sau <\/span>func\u021biile <\/span>de <\/span>securitate\nintegrate \u00een sistemele de operare \u0219i dispozitivele d<\/span>e re\u021bea, ar trebui s\u0103 poat\u0103 lua automat ac\u021biuni pentru limitarea\nsau eliminarea amenin\u021b\u0103rilor<\/span>, atunci\nc\u00e2nd este cazul.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Echipele de r\u0103spuns la incidente ar\ntrebui s\u0103 poat\u0103 alege \u0219i executa manual ac\u021biuni pentru oprirea \u0219i eliminarea\nincidentelor atunci c\u00e2nd <\/span>este necesar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>P\u0103r\u021bile <\/span>ter\u021be <\/span>de <\/span>\u00eencredere, <\/span>precum <\/span>ISP <\/span>sau <\/span>furnizori <\/span>de <\/span>servicii <\/span>de <\/span>securitate <\/span>gestionate, <\/span>ar <\/span>trebui s\u0103 <\/span>aib\u0103 <\/span>permisiunea <\/span>de <\/span>a <\/span>contribui <\/span>la <\/span>ac\u021biunile <\/span>de <\/span>limitare <\/span>\u0219i <\/span>eliminare, <\/span>dac\u0103 <\/span>aceasta <\/span>face <\/span>parte <\/span>din planul de r\u0103spuns al or<\/span>ganiza\u021biei.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RS.MI-01.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\ndetecteze accesul neautorizat sau scurgerile de date \u0219i s\u0103 ia ac\u021biunile\ncorespunz\u0103toare de atenuare, inclusiv monitorizarea sistemelor critice la\ngrani\u021bele externe \u0219i la punctele interne cheie.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>detecta\n<\/span>\u00een <\/span>timp <\/span>util <\/span>acce<\/span>sul <\/span>neautorizat <\/span>\u0219i <\/span>scurgerile <\/span>de <\/span>date <\/span>\u0219i <\/span>de\na <\/span>lua\n<\/span>ac\u021biunile <\/span>corespunz\u0103toare <\/span>de <\/span>atenuare. <\/span>Aceasta ar\n<\/span>trebui <\/span>s\u0103 <\/span>contribuie\n<\/span>la <\/span>proteja<\/span>rea confiden\u021bialit\u0103\u021bii, <\/span>integrit\u0103\u021bii, <\/span>disponibilit\u0103\u021bii <\/span>\u0219i <\/span>siguran\u021bei <\/span>da<\/span>telor, <\/span>indiferent <\/span>dac\u0103 <\/span>acestea <\/span>sunt <\/span>stocate,\ntransmise sau utilizate \u00een mod activ, at\u00e2t \u00een mediile IT, c\u00e2t \u0219i \u00een cele OT.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea sistemelor critice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea <\/span>ar <\/span>trebui <\/span>implementat\u0103 <\/span>la <\/span>grani\u021bele <\/span>re\u021belei\n<\/span>externe <\/span>\u0219i <\/span>\u00een <\/span>punctele <\/span>interne\n<\/span>cheie pentru detec\u021bia anomaliilor sau \u00eencerc\u0103rilor de acces neautorizat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea datelor \u00een toate st\u0103rile<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>ar <\/span>trebui\n<\/span>protejate <\/span>utiliz\u00e2nd <\/span>criptarea, <\/span>semn\u0103turi <\/span>digitale <\/span>\u0219i <\/span>hash<\/span>-uri <\/span>criptografice <\/span>pentru asigurarea confiden\u021bialit\u0103\u021bii \u0219i\nintegrit\u0103\u021bii \u00een timpul stoc\u0103rii, transmiterii \u0219i utiliz\u0103rii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Controlul comunica\u021biilor de ie\u0219ire<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Comunica\u021biile <\/span>externe <\/span>care <\/span>con\u021bin <\/span>date <\/span>sensibile <\/span>ar <\/span>trebui <\/span>bl<\/span>ocate <\/span>sau <\/span>criptate <\/span>automat\n<\/span>\u00een func\u021bie de clasificarea datelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Restric\u021biona<\/span>rea\nutiliz\u0103rii ser<\/span>viciilor personale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Accesul <\/span>la <\/span>platformele <\/span>de <\/span>comunicare <\/span>personale <\/span>(de <\/span>exemplu, <\/span>e<\/span>–<\/span>mail <\/span>personal, <\/span>servicii\n<\/span>de partajare <\/span>a <\/span>fi<\/span>\u0219ierelor) <\/span>din <\/span>sistemele <\/span>or<\/span>ganiza\u021biei <\/span>ar <\/span>trebui <\/span>restric\u021bionat <\/span>pentru <\/span>reducerea <\/span>risc<\/span>ului\nscur<\/span>gerii <\/span>de <\/span>date.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Prevenirea reutiliz\u0103rii datelor \u00een medii care nu sunt\nde produc\u021bie<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>sensibile <\/span>de <\/span>produc\u021bie <\/span>nu <\/span>ar <\/span>trebui <\/span>reutilizate <\/span>\u00een <\/span>medii <\/span>de <\/span>dezvoltare <\/span>sau <\/span>testare, <\/span>cu excep\u021bia cazului \u00een care sunt anonimizate\nsau mascate \u00een mod corespunz\u0103<\/span>tor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u0218ter<\/span>gerea\ndatelor temporare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele <\/span>sensibile <\/span>ar <\/span>trebui <\/span>\u0219terse <\/span>din <\/span>memorie <\/span>sau <\/span>din <\/span>spa\u021biul <\/span>de <\/span>stocare <\/span>temporar <\/span>odat\u0103 <\/span>ce <\/span>nu\nmai sunt necesare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Auditarea IAM<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>precum <\/span>AD <\/span>ar <\/span>trebui <\/span>auditate <\/span>periodic,\n<\/span>cu <\/span>accent <\/span>pe <\/span>conturile <\/span>privilegiate <\/span>\u0219i consecven\u021ba controlului accesului.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea fezabilit\u0103\u021bii specifice OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>\u00cen <\/span>mediile <\/span>OT<\/span>, <\/span>m\u0103surile <\/span>de <\/span>detec\u021bie <\/span>\u0219i <\/span>atenuare <\/span>ar <\/span>trebui <\/span>adaptate <\/span>pentru <\/span>evit<\/span>area <\/span>perturb\u0103rii\nsiguran\u021bei <\/span>sau <\/span>continuit\u0103\u021bii <\/span>opera\u021bionale. <\/span>Monitorizarea <\/span>pasiv\u0103 <\/span>\u0219i <\/span>jurnalizarea la <\/span>nivel <\/span>de interfa\u021b\u0103 pot\nfi utilizate \u00een cazul \u00een <\/span>care\nintegrarea direct\u0103 nu este fezabil\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Alinierea la recomand\u0103rile ENISA<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Aceste <\/span>practici <\/span>sunt <\/span>aliniate <\/span>cu <\/span>Ghidul <\/span>privind\n<\/span>scur<\/span>gerile <\/span>de <\/span>informa\u021bii <\/span>\u0219i <\/span>Rapoartele <\/span>privind peisajul <\/span>amenin\u021b\u0103rilor <\/span>elaborate <\/span>de <\/span>c\u0103tre <\/span>ENISA<\/span>, <\/span>care <\/span>furnizeaz\u0103 <\/span>recomand\u0103ri <\/span>pentru <\/span>detec\u021bia \u0219i\natenuarea <\/span>\u00eenc\u0103lc\u0103rilor securit\u0103\u021bii\ndatelor \u0219i a accesului neautorizat.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[RC.RP] EXECUTAREA PLANULUI DE RECUPERARE \u00ceN CAZ DE INCIDENT <\/span><\/b>Activit\u0103\u021bile <\/span>de <\/span>restaurare <\/span>sunt <\/span>efectuate <\/span>pentru <\/span>asigurarea <\/span>disponibilit\u0103<\/span>\u021bii <\/span>opera\u021bionale a <\/span>sistemelor\n<\/span>\u0219i serviciilor afectate de incidente de securitate cibernetic\u0103.<\/span><\/p>\n\n

RC.RP-01<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Partea <\/span>de <\/span>recuperare <\/span>a <\/span>IRP<\/span>-ului <\/span>este <\/span>executat\u0103 <\/span>odat\u0103 <\/span>ce <\/span>a <\/span>fost <\/span>ini\u021biat\u0103\n<\/span>din <\/span>procesul <\/span>de <\/span>r\u0103spuns <\/span>la incidente.<\/span><\/p>\n\n

RC.RP-01.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Trebuie <\/span>elaborat <\/span>\u0219i <\/span>executat\n<\/span>un <\/span>proces <\/span>de <\/span>recu<\/span>perare\n<\/span>\u00een <\/span>caz <\/span>de <\/span>dezastre <\/span>\u0219i <\/span>incidente <\/span>de <\/span>securitate\ncibernetic\u0103 sau a informa\u021biei.<\/span><\/p>\n\n

GHID DE IMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>organiza\u021bia <\/span>poate <\/span>r\u0103spunde <\/span>rapid <\/span>\u0219i <\/span>eficace\n<\/span>la <\/span>dezastre, incidente de\nsecuritate a informa\u021biei \u0219i evenimente de securitate cibernetic\u0103, prin\nelaborarea \u0219i executarea unui proces structurat de recuperare care protejeaz\u0103\npersoanele, sistemele \u0219i datele.<\/span><\/p>\n\n

\u00cen\nvederea realiz\u0103rii acestui obiectiv, ar trebui luate \u00een considerare urm\u0103toarel<\/span>e:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Elaborarea unui proces de recuperare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Un <\/span>proces <\/span>documentat <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>ghideze <\/span>ac\u021biunile <\/span>imediate <\/span>\u00een <\/span>cazul\n<\/span>unui <\/span>incendiu, <\/span>unei ur<\/span>gen\u021be\nmedicale, unui furt, unui dezastru natural sau unui incident de securitate cibe<\/span>rnetic\u0103 sau a informa\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Definirea rolurilor \u0219i res<\/span>ponsabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesul <\/span>de <\/span>recuperare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>speci<\/span>fice <\/span>cine <\/span>este <\/span>autorizat <\/span>s\u0103 <\/span>ini\u021bieze <\/span>procedu<\/span>rile <\/span>de recuperare \u0219i cine va comunica cu\np\u0103r\u021bile interesate externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Protejarea informa\u021biilor \u0219i a sistemelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesul <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>includ\u0103 <\/span>m\u0103suri <\/span>pentru <\/span>securizarea <\/span>informa\u021biilor <\/span>\u0219i <\/span>a <\/span>sistemelor<\/span>, <\/span>precum oprirea <\/span>sau <\/span>blocarea <\/span>dispozitivelor<\/span>, <\/span>trecerea <\/span>la <\/span>site<\/span>-uri de\n<\/span>rezerv\u0103 <\/span>sau <\/span>securizarea documentelor fizice.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea procedurilor de contact<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>men\u021binut\u0103 <\/span>o <\/span>list\u0103 <\/span>de <\/span>contacte <\/span>interne\n<\/span>\u0219i <\/span>externe, <\/span>care <\/span>s\u0103 <\/span>fie <\/span>inclus\u0103 <\/span>\u00een <\/span>planul <\/span>de recuperare pentru a putea fi accesat\u0103\nrapid \u00een cazul unui incident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea con\u0219tientiz\u0103rii \u0219i preg\u0103tirii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Persoanele <\/span>fizice <\/span>responsabile <\/span>cu <\/span>recuperarea <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>familiarizate <\/span>cu <\/span>planul <\/span>de recuperare \u0219i s\u0103 \u00een\u021beleag\u0103\nautoriza\u021biile necesare pentru efectuarea fiec\u0103rei etape.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Integrarea cu IRP<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procesul <\/span>de <\/span>recuperare <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fac\u0103 <\/span>parte <\/span>din <\/span>IRP<\/span>-ul <\/span>mai <\/span>lar<\/span>g <\/span>sau <\/span>s\u0103 <\/span>fie <\/span>aliniat\n<\/span>cu <\/span>acesta, pentru a asigura\nconsecv<\/span>en\u021ba \u0219i coordonarea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Includerea mediilor OT<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Planificarea <\/span>recuper\u0103rii <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>abordeze <\/span>sistemele <\/span>OT<\/span>, <\/span>i<\/span>nclusiv <\/span>procedurile <\/span>de <\/span>restabilire a\nopera\u021biunilor industriale, securizarea sisteme<\/span>lor\nde control \u0219i coordonarea cu protocoalele de siguran\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Planificarea <\/span>\u00eembun\u0103t\u0103\u021birilor <\/span>viitoare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Acest <\/span>Control <\/span>serve\u0219te <\/span>drep<\/span>t <\/span>baz\u0103 <\/span>pentru <\/span>planificarea <\/span>mai <\/span>avansat\u0103 <\/span>a <\/span>rec<\/span>uper\u0103rii, <\/span>astfel <\/span>cum este\ndezvoltat \u00een continuare \u00een Controlul RC.RP-06.1.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RC.RP-02<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Ac\u021biunile de recuperare sunt selectate, delimitate,\nprioritizate \u0219<\/span>i efectuate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RC.RP-02.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Func\u021biile <\/span>\u0219i <\/span>serviciile <\/span>esen\u021biale <\/span>ale <\/span>organiza\u021biei <\/span>tr<\/span>ebuie <\/span>continuate <\/span>cu <\/span>pierd<\/span>eri <\/span>minime <\/span>sau <\/span>f\u0103r\u0103 <\/span>pierderi \u00een <\/span>ceea <\/span>ce <\/span>prive\u0219te\n<\/span>continuitatea <\/span>opera\u021bional\u0103, <\/span>iar <\/span>continuitatea <\/span>trebuie\n<\/span>men\u021binut\u0103 <\/span>p\u00e2n\u0103 <\/span>la <\/span>recuperarea\ncomplet\u0103 a sistemului.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>minimiza <\/span>\u00eentreruperea <\/span>opera\u021biunilor <\/span>critice <\/span>\u00een <\/span>timpul <\/span>incidentelor \u0219i de a se asigura c\u0103 acestea\nr\u0103m\u00e2n func\u021bionale p\u00e2n\u0103 la restabilirea complet\u0103 a sistemelor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele<\/span>:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Planificarea <\/span>continuit\u0103\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>men\u021binut <\/span>un <\/span>BCP <\/span>pentru <\/span>identificarea <\/span>func\u021biilor <\/span>esen\u021biale <\/span>\u0219i <\/span>definirea <\/span>procedurilor pentru func\u021bionarea\nne\u00eentrerupt\u0103 \u00een timpul incidentelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>inclus\n<\/span>un <\/span>IRP<\/span>, <\/span>care <\/span>s\u0103 <\/span>detalieze <\/span>pa\u0219ii\n<\/span>pentru <\/span>limitarea  <\/span>incidentului, <\/span>evaluare<\/span>a daunelor\n\u0219i recuperarea etapizat\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Men\u021binerea opera\u021biunilo<\/span>r <\/span>p\u00e2n\u0103 la recuperare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>M\u0103surile\nde continuitate ar trebui s\u0103 sus\u021bin\u0103 func\u021bi<\/span>ile\nesen\u021biale p\u00e2n\u0103 la resta<\/span>bilirea\ncomplet\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Pentru <\/span>men\u021binerea <\/span>opera\u021biunilor<\/span>, <\/span>ar <\/span>tr<\/span>ebui <\/span>utilizate\n<\/span>sol<\/span>u\u021bii <\/span>temporare, <\/span>sisteme <\/span>redundante <\/span>sau proceduri manuale, acolo unde este necesar<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Prioritizarea recuper\u0103rii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Analiza  <\/span><\/span>im<\/span>pactului\n <\/span><\/span>asupra\n <\/span><\/span>activit\u0103\u021bii\n <\/span><\/span>\u0219i\n <\/span><\/span>clasificarea\n <\/span><\/span>sistemelor\n <\/span><\/span>ar\n <\/span><\/span>trebui\n <\/span><\/span>utilizate\n <\/span><\/span>pentru\ndefinirea priorit\u0103\u021bilor de recuperare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele <\/span>ar <\/span>trebui <\/span>clasificate <\/span>\u00een <\/span>func\u021bie <\/span>de <\/span>impactul <\/span>pierderii\n<\/span>disponibilit\u0103\u021bii, <\/span>integrit\u0103\u021bii <\/span>sau confiden\u021bialit\u0103\u021bii, acord\u00e2nd o aten\u021bie\nspecial\u0103 me<\/span>diilor OT <\/span>critice pentru siguran\u021b\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Asigurarea rezilien\u021bei datelor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar <\/span>trebui <\/span>im<\/span>plementate <\/span>solu\u021bii\n<\/span>robuste <\/span>de <\/span>backup\n<\/span>pentru <\/span>permiterea <\/span>restaur\u0103rii <\/span>rapide <\/span>\u0219i <\/span>fiabile a datelor<\/span>.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Backup-urile\nar trebui securizate \u0219i testate period<\/span>ic.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i reac\u021bia<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Sistemele\nar trebui monitorizate continuu pentru detec\u021bia din timp a eventualelor\n\u00eentreruperi.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ar\ntrebui luate ac\u021biuni de <\/span>r\u0103spuns rapid\npentru minimizarea impactului opera\u021bional.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>T<\/span>estarea <\/span>\u0219i <\/span>\u00eembun\u0103t\u0103\u021birea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Procedurile\nde recuperare ar trebui testate periodic pentru a asigura eficacitatea\nacestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Ac\u021biunile <\/span>de <\/span>recuperare <\/span>ar <\/span>trebui <\/span>documentate <\/span>\u0219i <\/span>revizuite <\/span>pentru\n<\/span>\u00eembun\u0103t\u0103\u021birea <\/span>gradului <\/span>de preg\u0103tire <\/span>\u00een <\/span>timp.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RC.RP-05<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Se\n<\/span>verific\u0103 <\/span>integritatea <\/span>activelor\n<\/span>restaurate, <\/span>sunt <\/span>restaurate <\/span>sistemele <\/span>\u0219i <\/span>serviciile <\/span>\u0219i <\/span>se <\/span>confirm\u0103\n<\/span>starea normal\u0103 de func\u021bionare.<\/span><\/p>\n\n

RC.RP-05.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Integritatea <\/span>sistemelor <\/span>\u0219i <\/span>a <\/span>activelor <\/span>restaurate <\/span>trebui<\/span>e <\/span>verificat\u0103 <\/span>\u00eenainte <\/span>de <\/span>repunerea\n<\/span>\u00een <\/span>func\u021biune. Sistemele \u0219i\nserviciile trebuie restaurate complet, iar func\u021bionarea normal\u0103 trebuie\nconfirmat\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>este <\/span>de a asigura <\/span>c\u0103 sistemele \u0219i <\/span>serviciile\nnu <\/span>sunt <\/span>doar resta<\/span>urate dup\u0103\nun incident, <\/span>ci <\/span>\u0219i <\/span>verificate <\/span>pentru <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>sunt <\/span>sigure, <\/span>necompromise <\/span>\u0219i <\/span>complet <\/span>func\u021bionale <\/span>\u00eenainte de a reveni la func\u021bionarea normal\u0103.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Sistemele <\/span>re<\/span>staur<\/span>ate <\/span>ar <\/span>trebui <\/span>verificate <\/span>pentru <\/span>semne <\/span>de <\/span>compromitere, <\/span>precum <\/span>malware <\/span>sau acces neautorizat, \u00eenainte <\/span>de a fi readuse \u00een func\u021biune.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Cauza <\/span>principal\u0103 <\/span>a <\/span>incidentului <\/span>ar <\/span>trebui <\/span>identificat\u0103 <\/span>\u0219i <\/span>remediat\u0103 <\/span>pentru\n<\/span>prevenirea <\/span>repet\u0103rii\nacestuia.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>T<\/span>oate <\/span>ac\u021biunile <\/span>de <\/span>recuperare <\/span>ar <\/span>trebui <\/span>revizuite\n<\/span>pentru <\/span>a <\/span>asigura\n<\/span>c\u0103 <\/span>au <\/span>fost <\/span>realizate <\/span>corect <\/span>\u0219i <\/span>c\u0103 nu mai exist\u0103 lacune de securitate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>O <\/span>verificare <\/span>final\u0103\n<\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>confirme <\/span>c\u0103 <\/span>sistemul <\/span>este <\/span>sigur<\/span>, <\/span>complet <\/span>\u0219i <\/span>preg\u0103tit <\/span>pentru\n<\/span>utilizarea normal\u0103.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RC.RP-06<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Finalizarea <\/span>recuper\u0103rii <\/span>incidentului <\/span>este <\/span>declarat\u0103 <\/span>pe <\/span>baza <\/span>unor <\/span>criterii, <\/span>iar <\/span>documenta\u021bia <\/span>referitoare la incident este completat\u0103.<\/span><\/p>\n\n

RC.RP-06.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Finalizarea <\/span>recuper\u0103rii <\/span>incidentului <\/span>trebuie\n<\/span>declarat\u0103 <\/span>formal, <\/span>pe <\/span>baza <\/span>unor <\/span>criterii <\/span>prede<\/span>finite, <\/span>iar <\/span>toat\u0103\ndocumenta\u021bia referitoare la incident trebuie completat\u0103 \u0219i revizuit\u0103.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui Control este de a\nasigura c\u0103 procesul de recuperare dup\u0103 incident este \u00eencheiat \u00een mod oficial \u0219i\nresponsabil \u0219i c\u0103 este completat\u0103 o documenta\u021bie cupr<\/span>inz\u0103toare pentru a spriji<\/span>ni\nr\u0103spunderea, \u00eenv\u0103\u021barea \u0219i preg\u0103tirea p<\/span>entru\nviitor.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar trebui \u00eentocmit un raport post-ac\u021biune care s\u0103 includ\u0103: <\/span>o <\/span><\/span>Un rezumat al incidentului \u0219i <\/span>al <\/span>impactului\nacestuia. <\/span>o   <\/span><\/span>Pa\u0219ii\nurma\u021bi pentru r\u0103spu<\/span>ns \u0219i recuperare.<\/span><\/p>\n\n

o <\/span><\/span>Lec\u021biile \u00eenv\u0103\u021bate \u0219i\nrecomand\u0103rile pentru \u00eembun\u0103t\u0103<\/span>\u021bire.<\/span><\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>\u00cenainte de a declara faza de recuperare finalizat\u0103, ar\ntrebui \u00eendeplinite urm\u0103toarele criterii:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate sistemele \u0219i\nserviciile afectate sunt deplin opera\u021bionale.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Nu\nmai exist\u0103 amenin\u021b\u0103ri sau vulnera<\/span>bilit\u0103\u021bi\ncunoscute \u00een mediu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Datele\nau fost restaurate \u0219i verificate <\/span>din\npunct de vedere al integrit\u0103\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Au\nfost aplicate patch-urile sau actualiz\u0103rile de securitate necesare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Este\nefectuat\u0103 monitorizarea pentru detec\u021bia oric\u0103rei probleme recurente s<\/span>au conexe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Raportul\npost-ac\u021biune este finalizat \u0219i revizuit de p\u0103r\u021bile interesate relevante.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>T<\/span>oate p\u0103r\u021bile\ninteresate sunt informate c\u0103 incidentul a fost rezolvat.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

[RC.CO]\nCOMUNICAREA PRIV<\/span>IND RECUPERAREA\nINCIDENTULUI<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile de restaurare sunt coordonate cu p\u0103r\u021bile\ninterne \u0219i externe.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

RC.CO-03<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile de <\/span>recupera<\/span>re <\/span>\u0219i <\/span>progresul <\/span>\u00eenregistrat <\/span>\u00een <\/span>restabilirea <\/span>capabilit\u0103\u021bilor <\/span>opera\u021bionale <\/span>sunt\ncomunicate <\/span>p\u0103r\u021bilor <\/span>interesate <\/span>interne <\/span>\u0219i <\/span>externe\n<\/span>desemnate.<\/span><\/p>\n\n

RC.CO-03.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Activit\u0103\u021bile de\nrecuperare \u0219i progresul \u00eenregistrat \u00een restabilirea capabilit\u0103\u021bilor\nopera\u021bionale trebuie comunicate <\/span>p\u0103r\u021bilor <\/span>interesate\n<\/span>interne <\/span>\u0219i <\/span>externe <\/span>desemnate, <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>procedurile\nde comunicare <\/span>stabilite.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Con<\/span>trol <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>eforturile\n<\/span>de recuperare <\/span>\u0219i <\/span>progresul\n<\/span>restabilirii capabilit\u0103\u021bilor opera\u021bionale sunt comunicate \u00een mod clar \u0219i\nconsecvent tuturor p\u0103r\u021bilor interesate interne \u0219i externe relevante. <\/span>Aceasta sprijin\u0103 transparen\u021ba, coordonarea\n\u0219i luarea de decizii informate \u00een timpul fazei de recuperare a unui incident.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Actualiz\u0103rile <\/span>privind <\/span>recuperarea, <\/span>inclusiv\n<\/span>progres<\/span>ul <\/span>\u00eenregistrat <\/span>\u00een <\/span>ceea ce <\/span>prive\u0219te restabilirea sistemelor \u0219i\nserviciilor<\/span>, ar trebui comunicate \u00een\nmod securizat \u0219i consecvent p\u0103r\u021bilor interesate interne <\/span>\u0219i <\/span>externe, <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>planurile <\/span>de <\/span>r\u0103spuns <\/span>ale <\/span>or<\/span>ganiza\u021biei <\/span>\u0219i <\/span>acordurile <\/span>de <\/span>schimb\nde informa\u021bii.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Conducerea <\/span>superioar\u0103 <\/span>ar <\/span>trebui\n<\/span>s\u0103 <\/span>primeasc\u0103 <\/span>actualiz\u0103ri <\/span>periodice <\/span>cu <\/span>privire\n<\/span>la <\/span>stadiul <\/span>eforturilor de recuperare, \u00een special \u00een\ncazul incidentelor majore.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Protocoalele de comunicare definite\n\u00een contractele cu furnizorii \u0219i partenerii ar trebui res<\/span>pectate pentru asigurarea unui schimb de informa\u021bii prompt \u0219i\nprecis.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Comunicare<\/span>a de criz\u0103 cu furnizorii critici ar tre<\/span>bui coordonat\u0103 pentru sprijinirea ac\u021biunilor de recuperare <\/span>aliniate.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dac\u0103\n<\/span>nu <\/span>s-au <\/span>produs <\/span>incidente <\/span>reale, <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>or<\/span>ganizate\n<\/span>exe<\/span>rci\u021bii <\/span>te<\/span>oretice <\/span>pentru <\/span>testarea\n\u0219i validarea <\/span>procedurilor <\/span>de comunicare \u00een caz de recuperare \u0219i\ncoordonarea p\u0103r\u021bilor interesate.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RC.CO-04<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Actualiz\u0103rile <\/span>publice <\/span>privind <\/span>recuperarea <\/span>\u00een <\/span>urma <\/span>incidentelor <\/span>sunt <\/span>comunicate <\/span>utiliz\u00e2nd\n<\/span>metode <\/span>\u0219i mesaje aprobate.<\/span><\/p>\n\n

RC.CO-04.1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Actualiz\u0103rile <\/span>publice <\/span>pri<\/span>vind <\/span>recuperarea <\/span>\u00een <\/span>urma <\/span>incidentelor <\/span>trebuie <\/span>comunicate <\/span>utiliz\u00e2nd\n<\/span>metode de comunicare \u0219i mesaje aprobate, \u00een conformitate cu procedurile\nstabilite.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui <\/span>Control <\/span>este <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103 <\/span>c<\/span>omunicarea public\u0103 <\/span>\u00een <\/span>timpul <\/span>fazei <\/span>de <\/span>recuperare <\/span>a unui incident este exact\u0103, oportun\u0103 \u0219i transmis\u0103 pr<\/span>in canale aprobate, pentru men\u021binerea\n\u00eencrederii, gestionarea riscului reputa\u021biona<\/span>l\n\u0219i respectarea obliga\u021biilor legale sau de reglementare.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Metodele aprobate pentru comunicarea\npublic\u0103, pre<\/span>cum comunicatele de pres\u0103,\nsite<\/span>-urile web oficiale sau purt\u0103torii\nde cuv\u00e2nt desemna\u021bi, ar trebui definite \u00een preala<\/span>bil \u0219i utilizate \u00een mo<\/span>d\nconsecvent.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar  <\/span><\/span>trebui  <\/span><\/span>stabilite  <\/span><\/span>\u0219i  <\/span><\/span>men\u021binute\n <\/span><\/span>informa\u021biile\n <\/span><\/span>de\n <\/span><\/span>contact\n <\/span><\/span>ale  <\/span>p\u0103r\u021bilor  <\/span><\/span>relevante  <\/span><\/span>(de  <\/span><\/span>exemplu,\npersonalul <\/span>intern, <\/span>v\u00e2nz\u0103torii <\/span>ter\u021bi, <\/span>autorit\u0103\u021bile <\/span>de <\/span>aplicare <\/span>a <\/span>legi<\/span>i, <\/span>furnizorii <\/span>de <\/span>asigur\u0103ri <\/span>cibernetice, agen\u021biile guvernamental<\/span>e).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Listele de contacte ar trebui\nrevizuite \u0219i verificate periodic (de exemplu, anual) pentru a asigura\nacurate\u021bea acestora.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Ar trebui identificate mecanismele de\ncomunicare primare \u0219i secundare (de exemplu, apeluri telefonice, <\/span>e-mailuri, <\/span>scrisori), <\/span>av\u00e2nd <\/span>\u00een <\/span>vedere <\/span>c\u0103 <\/span>unele <\/span>metode <\/span>pot <\/span>fi <\/span>indisponibile <\/span>\u00een <\/span>timpul <\/span>unui incident.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Protocoalele \u0219i mecanismele de\ncomunicare <\/span>ar trebui revizuite\nperiodic sau atunci c\u00e2nd au loc modific\u0103ri or<\/span>ganiza\u021bionale\nsemnificative.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span><\/span>Dac\u0103\n<\/span>nu <\/span>au <\/span>avut <\/span>loc <\/span>incidente\n<\/span>reale, <\/span>ar <\/span>trebui <\/span>s\u0103 <\/span>fie <\/span>or<\/span>ganizate\n<\/span>e<\/span>x<\/span>erci\u021bii <\/span>teoretice <\/span>sau <\/span>simul\u0103ri\npentru testarea procedurilor de comunicare public\u0103 \u0219i asigurarea preg\u0103tirii.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RC.CO-04.2<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia trebuie s\u0103\ndesem<\/span>neze un specialist \u00een rela\u021bii\npublice (PRO) pentru gestionarea comunic\u0103rii\n<\/span>publice <\/span>\u00een <\/span>timpul <\/span>rec<\/span>uper\u0103rii\n<\/span>\u00ee<\/span>n urma <\/span>incidentelor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>sau <\/span>a informa\u021biei, asigur\u00e2nd c\u0103 actualiz\u0103rile\npublice <\/span>sunt comunicate, men\u021bin\u00e2nd \u00een\nacela\u0219i timp confiden\u021bialitatea, integritatea \u0219i acurate\u021bea informa\u021biilor.<\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul <\/span>acestui\n<\/span>Control <\/span>est<\/span>e <\/span>de <\/span>a <\/span>asigura <\/span>c\u0103, <\/span>pe <\/span>parcursul\n<\/span>recuper\u0103rii <\/span>dup\u0103 <\/span>un <\/span>incident <\/span>de <\/span>securitate\ncibernetic\u0103 <\/span>sau <\/span>a <\/span>informa\u021biei, <\/span>comunicarea <\/span>public\u0103 <\/span>este <\/span>gestionat\u0103 <\/span>\u00een <\/span>mod <\/span>profesionist, <\/span>este <\/span>corect\u0103 <\/span>\u0219i aliniat\u0103 <\/span>cu <\/span>standardele <\/span>de <\/span>confiden\u021bial<\/span>itate <\/span>\u0219i\nintegritate <\/span>ale <\/span>organiza\u021biei. <\/span>Prin desemnarea <\/span>unui <\/span>PRO, organiza\u021bia se asigur\u0103 c\u0103 mesajele\npublice sunt gestionate de o persoan\u0103 fizic\u0103 instruit\u0103, care poate men\u021bine\n\u00eencrederea, proteja reputa\u021bia organiza\u021biei \u0219i respecta cerin\u021bele legale \u0219i de\nreglementare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acest<\/span>ui obiectiv, ar trebui luate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Desemnarea <\/span>unui\nPRO:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Desemnarea <\/span>unei <\/span>persoane\n<\/span>fizice <\/span>calificate <\/span>care <\/span>s\u0103 <\/span>gestioneze <\/span>comunicarea <\/span>public\u0103 <\/span>\u00een <\/span>timpul\nrecuper\u0103rii \u00een urma incidentul<\/span>ui.\nFi\u0219a postului PR<\/span>O poate include <\/span>urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Elaborarea\nstrategiilor de comunicare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Redactarea\n\u0219i distribuirea <\/span>comunicatelor de\npres\u0103.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Construirea <\/span>\u0219i <\/span>men\u021binerea <\/span>rela\u021biilor <\/span>cu <\/span>jurnali\u0219tii <\/span>\u0219i <\/span>mass<\/span>-media <\/span>pentru <\/span>asigurarea <\/span>unei acoperiri pozitive (rela\u021bii cu mass<\/span>-media).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>   <\/span> <\/span><\/span>Gestionarea\n <\/span><\/span>comunic\u0103ri<\/span>i  <\/span><\/span>\u00een  <\/span><\/span>timpul  <\/span><\/span>crizelor  <\/span><\/span>pentru\n <\/span><\/span>men\u021binerea\n <\/span><\/span>reputa\u021biei\n <\/span><\/span>or<\/span>ganiza\u021biei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(managementul\ncrizelor).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>    <\/span>Urm\u0103rirea\nacoperirii mediatice \u0219i efectuarea de analize media pentru evaluarea percep\u021biei\npublicului (monitorizarea acoperirii mediatice).<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Elaborarea protocoalelor de <\/span>comunicare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Stabilirea <\/span>unor <\/span>protocoale\n<\/span>clare <\/span>pe <\/span>care <\/span>PRO <\/span>s\u0103 <\/span>le <\/span>respecte <\/span>atunci <\/span>c\u00e2nd <\/span>comunic\u0103 <\/span>actualiz\u0103ri publice, asigur\u00e2nd c\u0103 toate\ninforma\u021biile men\u021bin confiden\u021bialitatea, integritatea \u0219i acurate\u021bea.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruirea <\/span>\u0219i <\/span>preg\u0103tirea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Furnizarea de instruire p<\/span>entru\nPRO cu privire la strategiile de comunicare \u00een caz de incidente \u0219i asigurarea\nfaptului c\u0103 ace\u0219tia sunt preg\u0103ti\u021bi s\u0103 ac\u021bioneze rapid \u00een timpul unui incident.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuiri periodice<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Revizuirea <\/span>\u0219i <\/span>actualizarea <\/span>periodic\u0103 <\/span>a <\/span>protocoalelor <\/span>de <\/span>comuni<\/span>care <\/span>pentru <\/span>a <\/span>se <\/span>adapta <\/span>la <\/span>noile provoc\u0103ri \u0219i asigurarea eficacit\u0103\u021bii\nacestora.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

RC.CO-04.3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Organiza\u021bia <\/span>trebuie <\/span>s\u0103 <\/span>implementeze <\/span>o <\/span>strategie <\/span>de <\/span>comunicare <\/span>de <\/span>criz\u0103 <\/span>pentru <\/span>a <\/span>atenua <\/span>impactul\nnegativ pe parcursul unei crize \u0219i pentru a contribui la restabilir<\/span>ea reputa\u021biei sale dup\u0103 aceasta.<\/span><\/p>\n\n

GHID DE\nIMPLEMENTARE<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Obiectivul acestui\nControl este de a asigura c\u0103 organiza\u021bia este preg\u0103tit\u0103 s\u0103 gestioneze\ncomunicarea \u00een <\/span>mod <\/span>eficace\n<\/span>\u00een <\/span>timpul <\/span>\u0219i <\/span>dup\u0103 <\/span>o <\/span>criz\u0103, <\/span>pentru\n<\/span>minimizarea <\/span>prejudiciilor <\/span>aduse\n<\/span>reputa\u021biei, <\/span>men\u021biner<\/span>ea \u00eencrederii p\u0103r\u021bilor interesate \u0219i\nsprijinirea eforturilor de redresare.<\/span><\/p>\n\n

\u00cen vederea realiz\u0103rii acestui obiectiv, ar trebui\nluate \u00een considerare urm\u0103toarele:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Elaborarea strategiei<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Crearea  <\/span><\/span>unui  <\/span><\/span>plan  <\/span><\/span>cuprinz\u0103tor  <\/span><\/span>de  <\/span><\/span>comunicare  <\/span><\/span>de  <\/span><\/span>criz\u0103,\n <\/span><\/span>care\n <\/span><\/span>s\u0103\n <\/span><\/span>prezinte\n <\/span><\/span>proc<\/span>edurile  <\/span><\/span>de gestionare a comunic\u0103rii \u00een timpul\n\u0219i dup\u0103 o criz\u0103 cu angaja\u021bii, clien\u021bii, partenerii, autorit\u0103\u021bile de <\/span>reglementare <\/span>\u0219i <\/span>mass-media.\nAsigurarea <\/span>conformit\u0103\u021bii <\/span>tuturor <\/span>comunic\u0103rilor <\/span>cu <\/span>cerin\u021bele\nlegale \u0219i cu reglement\u0103rile aplicabile \u00een domeniu.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Atribuirea rolurilor \u0219i responsabilit\u0103\u021bilor<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Desemnarea <\/span>unei <\/span>echipe <\/span>de <\/span>comunicare <\/span>de <\/span>criz\u0103, <\/span>inclusiv\n<\/span>un <\/span>purt\u0103tor <\/span>de <\/span>cuv\u00e2nt, <\/span>care <\/span>s\u0103\ngestioneze <\/span>comunicarea <\/span>public\u0103 <\/span>\u0219i <\/span>intern\u0103.\n<\/span>Ar <\/span>trebui <\/span>considerat\u0103 <\/span>participarea <\/span>profesioni\u0219tilor\ndin <\/span>domeniul <\/span>rela\u021biilor <\/span>publice, <\/span>a <\/span>con<\/span>silierilor <\/span>juridici <\/span>\u0219i <\/span>a <\/span>conducerii <\/span>superioare <\/span>a <\/span>or<\/span>ganiza\u021biei.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Stabilirea canalelor de comunicare<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Identificarea  <\/span><\/span>\u0219i  <\/span><\/span>configurarea  <\/span><\/span>canalelor  <\/span><\/span>fiabile\n <\/span><\/span>pentru\n <\/span><\/span>diseminarea\n <\/span><\/span>informa\u021biilor<\/span>,  <\/span><\/span>precum re\u021belele <\/span>sociale, <\/span>comunicatele <\/span>de <\/span>pres\u0103 <\/span>\u0219i <\/span>platformele <\/span>de <\/span>comunicare <\/span>intern\u0103. Aco<\/span>perirea mediatic\u0103 \u0219i re\u021belele sociale ar trebui monitorizate \u00een\nmod continuu pentru identificarea informa\u021biilor <\/span>eronate <\/span>sau <\/span>reac\u021biilor <\/span>publice <\/span>negative. <\/span>Inadverten\u021bele <\/span>ar <\/span>trebui <\/span>corectate\n<\/span>imediat.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Instruire \u0219i exerci\u021bii<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Or<\/span>ganizarea <\/span>unor <\/span>sesiuni <\/span>de <\/span>instruire <\/span>periodice <\/span>\u0219i <\/span>simul\u0103ri <\/span>de <\/span>crize <\/span>pentru\n<\/span>a <\/span>asigura <\/span>c\u0103 <\/span>echipa\neste preg\u0103tit\u0103 s\u0103 r\u0103spund\u0103 \u00een mod eficace.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Monitorizarea \u0219i adaptarea<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Monitorizarea  <\/span><\/span>continu\u0103  <\/span><\/span>a  <\/span><\/span>situa\u021biei  <\/span><\/span>\u0219i  <\/span><\/span>adapt<\/span>area  <\/span><\/span>strategiei  <\/span><\/span>de  <\/span><\/span>comunicare  <\/span><\/span>\u00een  <\/span><\/span>func\u021bie\n <\/span><\/span>de\nnecesitate pentru a gestiona circumstan\u021bele \u00een schimbare.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/span><\/span>  <\/span> <\/span><\/span><\/span>Revizuirea p<\/span>ost<\/span>-criz\u0103<\/span><\/p>\n\n

 <\/span><\/p>\n\n

o <\/span><\/span>Dup\u0103 <\/span>criz\u0103, <\/span>revizuirea <\/span>eforturilor <\/span>de <\/span>comunicare <\/span>pentru <\/span>identificarea <\/span>lec\u021biilor\n<\/span>\u00eenv\u0103\u021bate <\/span>\u0219i pentru\n\u00eembun\u0103t\u0103\u021birea r\u0103spunsurilor viitoare.<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

Aplicabilitatea\nControalelor pe niveluri <\/span>de asigurare<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Controalele marcate ca M\u0103suri cheie\n\u0219i Con<\/span>troalele aferente Aspectelor de\nmanagement sunt prev\u0103zute <\/span>\u00een <\/span>tabelul <\/span>urm\u0103tor. <\/span>Semnul <\/span>\u201eX\u201d <\/span>din <\/span>coloanele <\/span>\u201eNivelul <\/span>de <\/span>Baz\u0103\u201d, <\/span>\u201eNivelul <\/span>Important\u201d\n<\/span>\u0219i<\/span><\/p>\n\n

\n\n<\/span><\/span><\/p>\n \n
\n \n \n
\n
\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Nr.<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

crt.<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

Codul<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

Controlului<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

Nivelul<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

de Baz\u0103<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

Nivelul<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

Important<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

Nivelul<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

Esen\u021bial<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

M\u0103sur\u0103<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

cheie<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

Aspect<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

de management<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

GUVERNARE (GV)<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

1<\/span><\/p>\n <\/td>\n

\n

GV.OC-01.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

2<\/span><\/p>\n <\/td>\n

\n

GV.OC-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

3<\/span><\/p>\n <\/td>\n

\n

GV.OC-03.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

4<\/span><\/p>\n <\/td>\n

\n

GV.OC-03.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

5<\/span><\/p>\n <\/td>\n

\n

GV.OC-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

6<\/span><\/p>\n <\/td>\n

\n

GV.OC-04.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

7<\/span><\/p>\n <\/td>\n

\n

GV.OC-04.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

8<\/span><\/p>\n <\/td>\n

\n

GV.OC-04.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

9<\/span><\/p>\n <\/td>\n

\n

GV.OC-05.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

10<\/span><\/p>\n <\/td>\n

\n

GV.OV-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

11<\/span><\/p>\n <\/td>\n

\n

GV.OV-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

12<\/span><\/p>\n <\/td>\n

\n

GV.PO-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

13<\/span><\/p>\n <\/td>\n

\n

GV.PO-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

14<\/span><\/p>\n <\/td>\n

\n

GV.RM-01.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

15<\/span><\/p>\n <\/td>\n

\n

GV.RM-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

16<\/span><\/p>\n <\/td>\n

\n

GV.RM-03.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

17<\/span><\/p>\n <\/td>\n

\n

GV.RM-03.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

18<\/span><\/p>\n <\/td>\n

\n

GV.RM-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

19<\/span><\/p>\n <\/td>\n

\n

GV.RM-05.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

20<\/span><\/p>\n <\/td>\n

\n

GV.RR-01.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

21<\/span><\/p>\n <\/td>\n

\n

GV.RR-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

22<\/span><\/p>\n <\/td>\n

\n

GV.RR-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

23<\/span><\/p>\n <\/td>\n

\n

GV.RR-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

24<\/span><\/p>\n <\/td>\n

\n

GV.RR-03.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n <\/tbody><\/table>\n

 <\/p>\n <\/div>\n <\/td>\n <\/tr>\n <\/tbody><\/table>\n <\/span> <\/td>\n <\/tr>\n<\/tbody><\/table>\n\n\u201eNivelul <\/span>Esen\u021bial\u201d <\/span>indic\u0103 <\/span>faptul <\/span>c\u0103 <\/span>respectivul <\/span>Control\n<\/span>se <\/span>aplic\u0103 <\/span>la <\/span>nivelul <\/span>de <\/span>asigurare <\/span>corespunz\u0103tor. Coloana \u201eM\u0103sur\u0103 cheie\u201d\nmarcheaz\u0103, prin semnul \u201eX\u201d, Controalele care trebuie tratate cu prioritate, iar\ncoloana \u201eAspect de management\u201d marcheaz\u0103, prin semnul \u201eX\u201d, Controalele aferente\nAspe<\/span>ctelor de management.<\/span>

<\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

25<\/span><\/p>\n <\/td>\n

\n

GV.RR-04.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

26<\/span><\/p>\n <\/td>\n

\n

GV.RR-04.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

27<\/span><\/p>\n <\/td>\n

\n

GV.SC-01.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

28<\/span><\/p>\n <\/td>\n

\n

GV.SC-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

29<\/span><\/p>\n <\/td>\n

\n

GV.SC-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

30<\/span><\/p>\n <\/td>\n

\n

GV.SC-05.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

31<\/span><\/p>\n <\/td>\n

\n

GV.SC-05.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

32<\/span><\/p>\n <\/td>\n

\n

GV.SC-05.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

33<\/span><\/p>\n <\/td>\n

\n

GV.SC-06.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

34<\/span><\/p>\n <\/td>\n

\n

GV.SC-07.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

35<\/span><\/p>\n <\/td>\n

\n

GV.SC-07.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

36<\/span><\/p>\n <\/td>\n

\n

GV.SC-07.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

37<\/span><\/p>\n <\/td>\n

\n

GV.SC-07.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

38<\/span><\/p>\n <\/td>\n

\n

GV.SC-08.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

39<\/span><\/p>\n <\/td>\n

\n

GV.SC-09.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

40<\/span><\/p>\n <\/td>\n

\n

GV.SC-10.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

IDENTIFICARE\n (ID)<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

41<\/span><\/p>\n <\/td>\n

\n

ID.AM-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

42<\/span><\/p>\n <\/td>\n

\n

ID.AM-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

43<\/span><\/p>\n <\/td>\n

\n

ID.AM-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

44<\/span><\/p>\n <\/td>\n

\n

ID.AM-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

45<\/span><\/p>\n <\/td>\n

\n

ID.AM-02.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

46<\/span><\/p>\n <\/td>\n

\n

ID.AM-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

47<\/span><\/p>\n <\/td>\n

\n

ID.AM-02.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

48<\/span><\/p>\n <\/td>\n

\n

ID.AM-02.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

49<\/span><\/p>\n <\/td>\n

\n

ID.AM-02.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

50<\/span><\/p>\n <\/td>\n

\n

ID.AM-03.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

51<\/span><\/p>\n <\/td>\n

\n

ID.AM-03.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

52<\/span><\/p>\n <\/td>\n

\n

ID.AM-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

53<\/span><\/p>\n <\/td>\n

\n

ID.AM-04.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

54<\/span><\/p>\n <\/td>\n

\n

ID.AM-05.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

55<\/span><\/p>\n <\/td>\n

\n

ID.AM-07.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

56<\/span><\/p>\n <\/td>\n

\n

ID.AM-07.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

57<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.2<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n<\/tbody><\/table>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

58<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

59<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

60<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

61<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.6<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

62<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.7<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

63<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.8<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

64<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.9<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

65<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.10<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

66<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.11<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

67<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.12<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

68<\/span><\/p>\n <\/td>\n

\n

ID.AM-08.13<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

69<\/span><\/p>\n <\/td>\n

\n

ID.IM-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

70<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

71<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

72<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

73<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

74<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

75<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.6<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

76<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.7<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

77<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.8<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

78<\/span><\/p>\n <\/td>\n

\n

ID.IM-03.9<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

79<\/span><\/p>\n <\/td>\n

\n

ID.IM-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

80<\/span><\/p>\n <\/td>\n

\n

ID.IM-04.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

81<\/span><\/p>\n <\/td>\n

\n

ID.RA-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

82<\/span><\/p>\n <\/td>\n

\n

ID.RA-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

83<\/span><\/p>\n <\/td>\n

\n

ID.RA-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

84<\/span><\/p>\n <\/td>\n

\n

ID.RA-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

85<\/span><\/p>\n <\/td>\n

\n

ID.RA-01.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

86<\/span><\/p>\n <\/td>\n

\n

ID.RA-01.6<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

87<\/span><\/p>\n <\/td>\n

\n

ID.RA-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

88<\/span><\/p>\n <\/td>\n

\n

ID.RA-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

89<\/span><\/p>\n <\/td>\n

\n

ID.RA-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

90<\/span><\/p>\n <\/td>\n

\n

ID.RA-05.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

91<\/span><\/p>\n <\/td>\n

\n

ID.RA-05.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n<\/tbody><\/table>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

92<\/span><\/p>\n <\/td>\n

\n

ID.RA-05.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

93<\/span><\/p>\n <\/td>\n

\n

ID.RA-06.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

94<\/span><\/p>\n <\/td>\n

\n

ID.RA-08.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

95<\/span><\/p>\n <\/td>\n

\n

ID.RA-08.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

PROTEC\u021aIE (PR)<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

96<\/span><\/p>\n <\/td>\n

\n

PR.AA-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

97<\/span><\/p>\n <\/td>\n

\n

PR.AA-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

98<\/span><\/p>\n <\/td>\n

\n

PR.AA-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

99<\/span><\/p>\n <\/td>\n

\n

PR.AA-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

100<\/span><\/p>\n <\/td>\n

\n

PR.AA-01.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

101<\/span><\/p>\n <\/td>\n

\n

PR.AA-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

102<\/span><\/p>\n <\/td>\n

\n

PR.AA-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

103<\/span><\/p>\n <\/td>\n

\n

PR.AA-03.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

104<\/span><\/p>\n <\/td>\n

\n

PR.AA-03.2<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

105<\/span><\/p>\n <\/td>\n

\n

PR.AA-03.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

106<\/span><\/p>\n <\/td>\n

\n

PR.AA-03.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

107<\/span><\/p>\n <\/td>\n

\n

PR.AA-03.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

108<\/span><\/p>\n <\/td>\n

\n

PR.AA-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

109<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

110<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.2<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

111<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.3<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

112<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.4<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

113<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

114<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.6<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

115<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.7<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

116<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.8<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

117<\/span><\/p>\n <\/td>\n

\n

PR.AA-05.9<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

118<\/span><\/p>\n <\/td>\n

\n

PR.AA-06.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

119<\/span><\/p>\n <\/td>\n

\n

PR.AA-06.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

120<\/span><\/p>\n <\/td>\n

\n

PR.AA-06.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

121<\/span><\/p>\n <\/td>\n

\n

PR.AA-06.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

122<\/span><\/p>\n <\/td>\n

\n

PR.AT-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

123<\/span><\/p>\n <\/td>\n

\n

PR.AT-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

124<\/span><\/p>\n <\/td>\n

\n

PR.AT-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n<\/tbody><\/table>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

125<\/span><\/p>\n <\/td>\n

\n

PR.AT-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

126<\/span><\/p>\n <\/td>\n

\n

PR.AT-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

127<\/span><\/p>\n <\/td>\n

\n

PR.AT-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

128<\/span><\/p>\n <\/td>\n

\n

PR.AT-02.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

129<\/span><\/p>\n <\/td>\n

\n

PR.DS-01.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

130<\/span><\/p>\n <\/td>\n

\n

PR.DS-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

131<\/span><\/p>\n <\/td>\n

\n

PR.DS-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

132<\/span><\/p>\n <\/td>\n

\n

PR.DS-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

133<\/span><\/p>\n <\/td>\n

\n

PR.DS-01.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

134<\/span><\/p>\n <\/td>\n

\n

PR.DS-01.6<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

135<\/span><\/p>\n <\/td>\n

\n

PR.DS-01.9<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

136<\/span><\/p>\n <\/td>\n

\n

PR.DS-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

137<\/span><\/p>\n <\/td>\n

\n

PR.DS-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

138<\/span><\/p>\n <\/td>\n

\n

PR.DS-10.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

139<\/span><\/p>\n <\/td>\n

\n

PR.DS-11.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

140<\/span><\/p>\n <\/td>\n

\n

PR.DS-11.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

141<\/span><\/p>\n <\/td>\n

\n

PR.DS-11.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

142<\/span><\/p>\n <\/td>\n

\n

PR.DS-11.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

143<\/span><\/p>\n <\/td>\n

\n

PR.DS-11.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

144<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

145<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.2<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

146<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

147<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

148<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

149<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.6<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

150<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.7<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

151<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.8<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

152<\/span><\/p>\n <\/td>\n

\n

PR.IR-01.9<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

153<\/span><\/p>\n <\/td>\n

\n

PR.IR-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

154<\/span><\/p>\n <\/td>\n

\n

PR.IR-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

155<\/span><\/p>\n <\/td>\n

\n

PR.IR-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

156<\/span><\/p>\n <\/td>\n

\n

PR.IR-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

157<\/span><\/p>\n <\/td>\n

\n

PR.PS-01.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

158<\/span><\/p>\n <\/td>\n

\n

PR.PS-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n<\/tbody><\/table>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

159<\/span><\/p>\n <\/td>\n

\n

PR.PS-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

160<\/span><\/p>\n <\/td>\n

\n

PR.PS-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

161<\/span><\/p>\n <\/td>\n

\n

PR.PS-01.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

162<\/span><\/p>\n <\/td>\n

\n

PR.PS-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

163<\/span><\/p>\n <\/td>\n

\n

PR.PS-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

164<\/span><\/p>\n <\/td>\n

\n

PR.PS-04.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

165<\/span><\/p>\n <\/td>\n

\n

PR.PS-04.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

166<\/span><\/p>\n <\/td>\n

\n

PR.PS-04.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

167<\/span><\/p>\n <\/td>\n

\n

PR.PS-04.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

168<\/span><\/p>\n <\/td>\n

\n

PR.PS-04.5<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

169<\/span><\/p>\n <\/td>\n

\n

PR.PS-05.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

170<\/span><\/p>\n <\/td>\n

\n

PR.PS-05.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

171<\/span><\/p>\n <\/td>\n

\n

PR.PS-06.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

172<\/span><\/p>\n <\/td>\n

\n

PR.PS-06.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

173<\/span><\/p>\n <\/td>\n

\n

PR.PS-06.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

174<\/span><\/p>\n <\/td>\n

\n

PR.PS-06.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

DETEC\u021aIE\n (DE)<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

175<\/span><\/p>\n <\/td>\n

\n

DE.AE-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

176<\/span><\/p>\n <\/td>\n

\n

DE.AE-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

177<\/span><\/p>\n <\/td>\n

\n

DE.AE-03.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

178<\/span><\/p>\n <\/td>\n

\n

DE.AE-03.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

179<\/span><\/p>\n <\/td>\n

\n

DE.AE-03.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

180<\/span><\/p>\n <\/td>\n

\n

DE.AE-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

181<\/span><\/p>\n <\/td>\n

\n

DE.AE-06.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

182<\/span><\/p>\n <\/td>\n

\n

DE.AE-08.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

183<\/span><\/p>\n <\/td>\n

\n

DE.CM-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

184<\/span><\/p>\n <\/td>\n

\n

DE.CM-01.2<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

185<\/span><\/p>\n <\/td>\n

\n

DE.CM-01.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

186<\/span><\/p>\n <\/td>\n

\n

DE.CM-01.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

187<\/span><\/p>\n <\/td>\n

\n

DE.CM-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

188<\/span><\/p>\n <\/td>\n

\n

DE.CM-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

189<\/span><\/p>\n <\/td>\n

\n

DE.CM-03.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

190<\/span><\/p>\n <\/td>\n

\n

DE.CM-03.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

191<\/span><\/p>\n <\/td>\n

\n

DE.CM-06.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n<\/tbody><\/table>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

192<\/span><\/p>\n <\/td>\n

\n

DE.CM-06.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

193<\/span><\/p>\n <\/td>\n

\n

DE.CM-09.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

194<\/span><\/p>\n <\/td>\n

\n

DE.CM-09.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

195<\/span><\/p>\n <\/td>\n

\n

DE.CM-09.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

196<\/span><\/p>\n <\/td>\n

\n

DE.CM-09.4<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

R\u0102SPUNS\n (RS)<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

197<\/span><\/p>\n <\/td>\n

\n

RS.AN-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

198<\/span><\/p>\n <\/td>\n

\n

RS.AN-06.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

199<\/span><\/p>\n <\/td>\n

\n

RS.AN-07.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

200<\/span><\/p>\n <\/td>\n

\n

RS.AN-08.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

201<\/span><\/p>\n <\/td>\n

\n

RS.CO-02.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

202<\/span><\/p>\n <\/td>\n

\n

RS.CO-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

203<\/span><\/p>\n <\/td>\n

\n

RS.MA-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

204<\/span><\/p>\n <\/td>\n

\n

RS.MA-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

205<\/span><\/p>\n <\/td>\n

\n

RS.MA-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

206<\/span><\/p>\n <\/td>\n

\n

RS.MA-02.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

207<\/span><\/p>\n <\/td>\n

\n

RS.MA-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

208<\/span><\/p>\n <\/td>\n

\n

RS.MA-05.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

209<\/span><\/p>\n <\/td>\n

\n

RS.MI-01.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

210<\/span><\/p>\n <\/td>\n

\n

RS.MI-01.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

RECUPERARE\n (RC)<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

211<\/span><\/p>\n <\/td>\n

\n

RC.CO-03.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n <\/tr>\n

\n

212<\/span><\/p>\n <\/td>\n

\n

RC.CO-04.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

213<\/span><\/p>\n <\/td>\n

\n

RC.CO-04.2<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

214<\/span><\/p>\n <\/td>\n

\n

RC.CO-04.3<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

215<\/span><\/p>\n <\/td>\n

\n

RC.RP-01.1<\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

216<\/span><\/p>\n <\/td>\n

\n

RC.RP-02.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

217<\/span><\/p>\n <\/td>\n

\n

RC.RP-05.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n

\n

218<\/span><\/p>\n <\/td>\n

\n

RC.RP-06.1<\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

X<\/span><\/b><\/span><\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n

\n

 <\/p>\n <\/td>\n <\/tr>\n<\/tbody><\/table>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

METODOLOGIA<\/span><\/b><\/span><\/p>\n\n
\n<\/span>\n\n

Anexa\nnr. 2<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/span><\/p>\n\n

de autoevaluare a maturit\u0103\u021bii m\u0103surilor\nde gestionare a riscurilor de securitate cibernetic\u0103<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

Articolul 1<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

(1) Directoratul Na<\/span>\u021bional de Securitate Cibernetic\u0103 dezvolt\u0103\n\u0219i pune la dispozi\u021bia tuturor entit\u0103\u021bilor esen\u021biale \u0219i importante dou\u0103\nmecanisme destinate s<\/span>tabilirii\nnivelului de maturitate a m\u0103surilor de gestionare <\/span>a <\/span>riscurilor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>ale <\/span>entit\u0103\u021bii, <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>art. <\/span>12 <\/span>alin. <\/span>(4) <\/span>\u0219i <\/span>art.<\/span><\/p>\n\n

37 alin. (8) lit. b) din Ordonan\u021ba de urgen\u021b\u0103 a\nGuvernului nr. 155\/2024, respectiv:<\/span><\/p>\n\n

 <\/span><\/p>\n\n

a)\n <\/span><\/span><\/span>Platforma NIS2@RO;<\/span><\/a><\/span><\/p>\n\n

 <\/span><\/p>\n\n

b)  <\/span>instrumentele <\/span>de <\/span>evaluare <\/span>a <\/span>maturit\u0103\u021bii <\/span>m\u0103surilor\n<\/span>de <\/span>gestionare <\/span>a <\/span>riscurilor <\/span>de <\/span>securitate\ncibernetic\u0103, corespunz\u0103toare fiec\u0103rui nivel de asigurare: EV<\/span>AL_MMS_B pentru nivelul de Baz\u0103,\nEVAL_MMS_I pentru nivelul Important \u0219i EVAL_MMS_E pentru nivelul E<\/span>s<\/span>en\u021bial.<\/span><\/p>\n\n

(2)\n<\/span>\u00cen <\/span>cazul <\/span>\u00een <\/span>care <\/span>Platforma <\/span><\/span>NIS2@<\/span>RO<\/span><\/a> <\/span>este <\/span>indisponibil\u0103, <\/span>se <\/span>utilizeaz\u0103 <\/span>instrumentele <\/span>de <\/span>evaluare <\/span>a maturit\u0103\u021bii,  <\/span><\/span>care  <\/span><\/span>se  <\/span><\/span>descarc\u0103\n <\/span><\/span>de\n <\/span><\/span>pe\n <\/span><\/span>website<\/span>-ul  <\/span><\/span>oficial  <\/span><\/span>al  <\/span><\/span>Directoratului  <\/span><\/span>Na\u021bional\n <\/span><\/span>de\n <\/span><\/span>Securit<\/span>ate<\/span> Cibernetic\u0103 (https:\/\/www.dnsc.ro\/) \u0219i se utilizeaz<\/span>\u0103 la nivel local, conform instruc\u021biunilor\npublicate. Articolul 2<\/b><\/span><\/a><\/span><\/p>\n\n

(1) Pentru calcularea\nscorului de maturitate, reprezent\u00e2nd gradul de conformitate al entit\u0103\u021bii cu\nControalele aplicabile nivelului s\u0103u de asigurare, se atribuie o valoare num\u0103r\n\u00eentreg de la 1 <\/span>la 5 fiec\u0103ruia dintre\nurm\u0103torii <\/span>doi parametri ata\u0219a\u021bi\nfiec\u0103rui Control:<\/span><\/p>\n\n

a)  <\/span><\/span>Maturitatea\ndocumenta\u021biei, <\/span>care <\/span>m\u0103soar\u0103\n<\/span>gradul <\/span>\u00een <\/span>car<\/span>e <\/span>regulile\n<\/span>\u0219i <\/span>proced<\/span>urile <\/span>scrise <\/span>satisfac cerin\u021bele Controlului;<\/span><\/p>\n\n

b) <\/span>Maturitatea implement\u0103rii, care m\u0103soar\u0103\ngrad<\/span>ul \u00een care practicile <\/span>opera\u021bionale efective corespund Controlului\n\u0219i documenta\u021biei aferente.<\/span><\/p>\n\n

(2) <\/span>Este <\/span>obligatorie <\/span>completarea <\/span>variabilelor \u201eScor <\/span>documenta\u021bie\u201d <\/span>\u0219i <\/span>\u201eScor <\/span>implementare\u201d <\/span>pentru fiecare Control.<\/span><\/p>\n\n

(3) <\/span>Atribuirea <\/span>valorilor <\/span>prev\u0103zute <\/span>la alin.\n<\/span>(1) <\/span>se <\/span>determin\u0103 <\/span>prin <\/span>evalu<\/span>area <\/span>satisfacerii <\/span>criteriilor <\/span>\u0219i\nvalorilor de prag conform stadiilor de maturitate predefinite, astfel:<\/span><\/p>\n\n

a)  <\/span><\/span>Stadiul  <\/span>1 \n<\/span>–  <\/span>Ini\u021bial:  <\/span>valoarea \n<\/span>maturit\u0103\u021bii  <\/span>1;  <\/span>a\u0219tept\u0103ri \n<\/span>privind  <\/span>nivelul  <\/span>de \n<\/span>maturitate  <\/span>a documenta\u021biei – \u201enu\nexis<\/span>t\u0103 documenta\u021bie a procesului <\/span>sau aceasta <\/span>nu este aprobat\u0103 ofi<\/span>cial\nde c\u0103tre <\/span>conducere\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201enu <\/span>exist\u0103\n<\/span>un <\/span>proces standard\u201d;<\/span><\/p>\n\n

b) <\/span>Stadiul\n<\/span>2 <\/span>– <\/span>Repetabil: valoarea mat<\/span>urit\u0103\u021bii <\/span>2; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a documenta\u021biei <\/span>– <\/span>\u201eexist\u0103 <\/span>documenta\u021bie <\/span>a <\/span>procesului <\/span>aprobat\u0103\n<\/span>oficial, <\/span>dar <\/span>care <\/span>nu <\/span>a <\/span>fost <\/span>revizuit\u0103<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

\u00een <\/span>ultimii <\/span>2 <\/span>ani\u201d; <\/span>a\u0219tept\u0103ri\n<\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces\nad-hoc, desf\u0103\u0219urat \u00een mod informal\u201d;<\/span><\/p>\n\n

c) <\/span>Stadiul 3 – Definit: valoarea maturit\u0103\u021bii\n3; a\u0219tept\u0103ri privind nivelul de maturitate a documenta\u021biei – \u201eexist\u0103\ndocumenta\u021bie a proce<\/span>sului aprobat\u0103\noficial, iar excep\u021biile sunt documentate <\/span>\u0219i <\/span>aprobate;\n<\/span>excep\u021biile <\/span>documentate <\/span>\u0219i <\/span>aprobate\nreprezint\u0103 <\/span>mai <\/span>pu\u021bin <\/span>de <\/span>5% <\/span>din\ncazuri\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind\n<\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces <\/span>formal,\n<\/span>care este <\/span>implementat; <\/span>sunt <\/span>disponibile <\/span>dovezi <\/span>pentru <\/span>majoritatea <\/span>activit\u0103\u021bilor; <\/span>excep\u021biile <\/span>de <\/span>proces\nsunt mai pu\u021bin de 10%\u201d;<\/span><\/p>\n\n

d) <\/span>Stadiul\n<\/span>4 <\/span>– <\/span>Gestionat: <\/span>valoarea mat<\/span>uri<\/span>t\u0103\u021bii <\/span>4; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a documenta\u021biei – \u201eexist\u0103 documenta\u021bie a\nproce<\/span>sului aprobat\u0103 oficial, iar\nexcep\u021biile sunt documentate <\/span>\u0219i <\/span>aprobate;\n<\/span>excep\u021biile <\/span>documentate <\/span>\u0219i <\/span>aprobate\nreprezint\u0103 <\/span>mai <\/span>pu\u021bin <\/span>de <\/span>3% <\/span>din\ncazuri\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind\n<\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces <\/span>formal,\n<\/span>care este implementat; sunt disponibile dovezi pentru toate acti<\/span>vit\u0103\u021bile; sunt colectate \u0219i raportate\nmetrici <\/span>detaliate <\/span>ale <\/span>proc<\/span>esului;\n<\/span>a <\/span>fost <\/span>stabili<\/span>t\u0103 <\/span>o \u021bint\u0103\n<\/span>minim\u0103 <\/span>pentru metrici; <\/span>excep<\/span>\u021biile <\/span>de proces sunt mai pu\u021bin de 5%\u201d;<\/span><\/p>\n\n

e)  <\/span>Stadiul <\/span>5 <\/span>– <\/span>Optimizare: <\/span>valoarea <\/span>maturit\u0103\u021bii <\/span>5; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a documenta\u021biei – \u201eexist\u0103 documenta\u021bie a\nproce<\/span>sului aprobat\u0103 oficial, iar\nexcep\u021biile sunt documentate <\/span>\u0219i <\/span>aprobate;\n<\/span>excep\u021biile <\/span>doc<\/span>umentate\n<\/span>\u0219i <\/span>aprobate <\/span>reprezint\u0103 <\/span>mai <\/span>pu\u021bin <\/span>de <\/span>0,5% <\/span>din cazuri\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul\n<\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces <\/span>formal,\n<\/span>care este implementat; sunt disponibile dovezi pentru toate acti<\/span>vit\u0103\u021bile; sunt colectate \u0219i raportate\nmetrici <\/span>deta<\/span>liate <\/span>ale <\/span>procesului; <\/span>a fost <\/span>stabilit\u0103 <\/span>o <\/span>\u021bint\u0103 <\/span>minim\u0103 <\/span>pentru <\/span>metrici, <\/span>care <\/span>se \u00eembun\u0103t\u0103\u021be\u0219te continuu; excep\u021biile de <\/span>proces sunt mai pu\u021bin de 1%\u201d.<\/span><\/p>\n\n

(4) <\/span>Variabilelor <\/span>\u201eScor <\/span>documenta\u021bie\u201d <\/span>\u0219i <\/span>\u201eScor <\/span>implementare\u201d <\/span>le <\/span>este atribuit\u0103 <\/span>valoarea\n<\/span>numeric\u0103 corespunz\u0103toare de la 1 la 5, aferent\u0103 stadiului de maturitate\nstabilit potri<\/span>vit alin. (3).<\/span><\/p>\n\n

(5) Pentru fiecare\nControl se atribuie valori pentru \u201eScor documenta\u021bie\u201d \u0219i \u201eScor implementare\u201d,\npotrivit alin. (4). Fiecare valoa<\/span>re\neste justificat\u0103 \u00een scris, prin informa\u021b<\/span>ii\n\u0219i argumente.<\/span><\/p>\n\n

(6) Pentru fiecare\nSubcategorie se calculeaz\u0103 \u201eScor maturitate documenta\u021bie\u201d \u0219i \u201eScor maturitate\nimplementare\u201d ca medie aritmetic\u0103 a valorilor corespunz\u0103toare ale Controale<\/span>lor din acea Subcategori<\/span>e.<\/span><\/p>\n\n

(7) Pentru fiecare\nCategorie se calculea<\/span>z\u0103 \u201eScor\nmaturitate documenta\u021bie\u201d \u0219i \u201eScor maturitate implementare\u201d ca medie aritmetic\u0103\na valorilor corespunz\u0103toare ale Subcategoriil<\/span>or\ndin acea Categorie.<\/span><\/p>\n\n

(8) Pentru fiecare\nCategorie se calculeaz\u0103 scorul de maturitate ca medie aritmetic\u0103 a scoruri<\/span>lor prev\u0103zute <\/span>la <\/span>alin. <\/span>(7).<\/span><\/p>\n\n<\/div>\n\n
\n<\/span>\n\n

\n\n

 <\/p>\n\n

 <\/p>\n\n

 <\/span><\/p>\n\n

(9) <\/span>Scorul <\/span>total <\/span>de <\/span>maturitate\n<\/span>al <\/span>entit\u0103\u021bii <\/span>se <\/span>ob\u021bine <\/span>ca <\/span>medie <\/span>aritmetic\u0103\n<\/span>a <\/span>scorurilor <\/span>de <\/span>maturitate <\/span>ale<\/span><\/p>\n\n

 <\/span><\/p>\n\n

Categoriilor.<\/span><\/p>\n\n

 <\/span><\/p>\n\n

(10) Scorurile pe Con<\/span>troale \u0219i pe Categorii, precum \u0219i scorul\ntotal de maturitate al entit\u0103\u021bii, indic\u0103 totodat\u0103 ecar<\/span>tul fa\u021b\u0103 de scorurile-\u021bint\u0103 <\/span>necesare\npentru atingerea conformit<\/span>\u0103\u021bii.<\/span><\/p>\n\n

(11) <\/span>Pentru <\/span>atingerea <\/span>conformit\u0103<\/span>\u021bii, <\/span>valorile\n<\/span>ob\u021binute <\/span>de <\/span>entitate\n<\/span>\u00een <\/span>urma autoevalu\u0103rii <\/span>sunt <\/span>cel <\/span>pu\u021bin egale cu urm\u0103toarele scoruri-\u021bint\u0103,\nstabilite pentru fi<\/span>ecare nivel de\nasigurare:<\/span><\/p>\n\n

a)  <\/span><\/span>pentru\nnivelul de Baz\u0103: scorul-\u021bint\u0103 al fiec\u0103rui Control marcat ca M\u0103sur\u0103 cheie este\nde cel pu\u021bin 2,5, iar scorul-\u021bint\u0103 total al <\/span>entit\u0103\u021bii\neste de cel pu\u021bin 2,5;<\/span><\/p>\n\n

b)  <\/span><\/span>pentru <\/span>nivelul <\/span>Important: <\/span>scorul<\/span>-\u021bint\u0103 <\/span>al <\/span>fiec\u0103rui\nControl <\/span>marcat <\/span>ca <\/span>M\u0103sur\u0103 <\/span>cheie <\/span>este <\/span>de <\/span>cel\npu\u021bin 3, iar scorul-\u021bint\u0103 total al entit\u0103\u021bii este de cel pu\u021bin 3;<\/span><\/p>\n\n

c)  <\/span><\/span>pentru\nnivelul Esen\u021bial: scorul-\u021bint\u0103 al fiec\u0103rui Control marcat ca M\u0103sur\u0103 cheie este\nde cel pu\u021bin <\/span>3, <\/span>scorul-\u021bint\u0103 <\/span>total <\/span>al <\/span>fiec\u0103rei\n<\/span>C<\/span>ategorii <\/span>este <\/span>de <\/span>cel <\/span>pu\u021bin <\/span>3, <\/span>iar <\/span>scorul\n<\/span>general <\/span>al <\/span>entit\u0103<\/span>\u021bii\neste de cel pu\u021bin 3,5.<\/span><\/p>\n\n

Articolul 3<\/span><\/b><\/span><\/p>\n\n

 <\/span><\/p>\n\n

Atunci c\u00e2nd, \u00een urma\nautoevalu\u0103rii, nu sunt atinse scorurile<\/span>-\u021bint\u0103\naferente nivelului de asigurare evaluat, prev\u0103zute la art. 2, entitatea are\nobliga\u021bia de a \u00eentocmi un plan de m\u0103suri pentru remedierea tuturor deficie<\/span>n\u021belor care au condus la neconformitate,\nplan ce cuprinde ac\u021biunile ce urmeaz\u0103 a fi \u00eentreprinse \u0219i termenele asumate\npentru implementare.<\/span><\/p>\n\n<\/div>

<\/span>


<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Art. 1 – Structura m\u0103surilor de gestionare a riscurilor de securitate cibernetic\u0103<\/p>\n

(1) M\u0103surile de gestionare a riscurilor de securitate cibernetic\u0103 sunt organizate \u00een \u0219ase Func\u021bii, dup\u0103 cum urmeaz\u0103:
\na) Guvernare (GV) – asigur\u0103 tratarea securit\u0103\u021bii cibernetice ca prioritate strategic\u0103 \u0219i stabile\u0219te politicile, responsabilit\u0103\u021bile \u0219i atribu\u021biile de autoritate, care sunt comunicate \u0219i revizuite la nivelul entit\u0103\u021bii;
\nb) Identificare (ID) – asigur\u0103 \u00een\u021belegerea activelor, sistemelor, persoanelor \u0219i datelor relevante, precum \u0219i a riscurilor asociate, fundament\u00e2nd deciziile privind gestionarea riscurilor de securitate cibernetic\u0103;
\nc) Protec\u021bie (PR) – cuprinde m\u0103surile de protec\u021bie, de natur\u0103 tehnic\u0103, procedural\u0103 \u0219i de con\u0219tientizare, menite s\u0103 reduc\u0103 probabilitatea producerii unui incident sau s\u0103 \u00eei limiteze impactul;
\nd) Detec\u021bie (DE) – sus\u021bine detec\u021bia prompt\u0103 a evenimentelor de securitate cibernetic\u0103, \u00een vederea reducerii daunelor \u0219i a unui r\u0103spuns mai rapid;
\ne) R\u0103spuns (RS) – cuprinde ac\u021biunile \u00eentreprinse la producerea unui incident, pentru limitarea acestuia, coordonarea comunic\u0103rii \u0219i reducerea perturb\u0103rilor;
\nf)\tRecuperare (RC) – vizeaz\u0103 restabilirea serviciilor \u0219i a opera\u021biunilor afectate de un incident, precum \u0219i valorificarea lec\u021biilor \u00eenv\u0103\u021bate pentru cre\u0219terea rezilien\u021bei.<\/p>\n","protected":false},"author":1,"featured_media":1931,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2343","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t